diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 05e37031..bb319fdd 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -79,7 +79,7 @@ jobs:
       - name: Install Node.js dependencies
         # npm ci requires a package-lock.json — skip gracefully until one is committed.
         if: hashFiles('package-lock.json') != ''
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Verify environment
         run: |
diff --git a/scripts/test-copilot-setup-steps-workflow.sh b/scripts/test-copilot-setup-steps-workflow.sh
new file mode 100644
index 00000000..690ff633
--- /dev/null
+++ b/scripts/test-copilot-setup-steps-workflow.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Regression guard: assert that copilot-setup-steps.yml contains the required
+# `npm ci --ignore-scripts` invocation (aligned with the org canonical template).
+#
+# Run: bash scripts/test-copilot-setup-steps-workflow.sh
+set -euo pipefail
+
+WORKFLOW=".github/workflows/copilot-setup-steps.yml"
+PASS=true
+
+echo "=== test-copilot-setup-steps-workflow ==="
+
+# ── Check 1: file exists ───────────────────────────────────────────────────
+if [[ ! -f "$WORKFLOW" ]]; then
+  echo "FAIL: $WORKFLOW not found"
+  exit 1
+fi
+echo "PASS: $WORKFLOW exists"
+
+# ── Check 2: npm ci uses --ignore-scripts ─────────────────────────────────
+if grep -qE 'npm ci([[:space:]]|$)' "$WORKFLOW" && ! grep -qE 'npm ci.*--ignore-scripts' "$WORKFLOW"; then
+  echo "FAIL: 'npm ci' found without '--ignore-scripts' in $WORKFLOW"
+  echo "      Update the step to: run: npm ci --ignore-scripts"
+  PASS=false
+elif grep -qE 'npm ci.*--ignore-scripts' "$WORKFLOW"; then
+  echo "PASS: 'npm ci --ignore-scripts' present in $WORKFLOW"
+else
+  echo "INFO: no 'npm ci' call found (step may be absent — OK if no package-lock.json guard)"
+fi
+
+# ── Check 3: install step has the hashFiles guard ─────────────────────────
+if ! grep -qE "hashFiles\([[:space:]]*['\"]package-lock\.json['\"][[:space:]]*\)" "$WORKFLOW"; then
+  echo "FAIL: hashFiles guard missing from $WORKFLOW — 'npm ci' must be conditional"
+  PASS=false
+else
+  echo "PASS: hashFiles guard present in $WORKFLOW"
+fi
+
+echo ""
+if [[ "$PASS" == "true" ]]; then
+  echo "All checks passed."
+else
+  echo "One or more checks failed."
+  exit 1
+fi