diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 6f3cb7cbb9..8330fbd510 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -65,19 +65,39 @@ jobs:
               shell: bash
               forge_platform: linux
     runs-on: ${{ matrix.os.image }}
+    defaults:
+      run:
+        # Under pnpm/action-setup's pnpm 12 bootstrap, `pnpm` invoked from PowerShell on the
+        # win-signing runner exits 0 without running anything, so the steps below have to
+        # reach it through the same shell the build uses.
+        shell: ${{ matrix.os.shell }}
+    env:
+      # "Update nightly version" rewrites the version field of six workspace manifests, which
+      # makes the next `pnpm run` re-install the whole workspace even though the dependency
+      # graph is unchanged. "Install dependencies" below is the authoritative install.
+      PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: "false"
     steps:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      # pnpm derives its store from PNPM_HOME, which pnpm/action-setup points inside the
+      # directory it reinstalls on every run. The win-signing runner is persistent, so the
+      # store has to sit somewhere that survives between jobs, and packages have to be copied
+      # out of it: rebuilding better-sqlite3 and electron-forge's pruning both write into
+      # node_modules, which a hardlink would carry back into the shared store.
+      - name: Keep the pnpm store outside the pnpm installation
+        if: ${{ matrix.os.name == 'windows' }}
+        shell: powershell
+        run: |
+          Add-Content -Path $env:GITHUB_ENV -Value "PNPM_CONFIG_STORE_DIR=C:\pnpm-store"
+          Add-Content -Path $env:GITHUB_ENV -Value "PNPM_CONFIG_PACKAGE_IMPORT_METHOD=copy"
       - name: Set up node & dependencies
         uses: actions/setup-node@v7
         with:
           node-version: 24
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-        env:
-          npm_config_package_import_method: copy
       - name: Update nightly version
         run: pnpm run chore:ci-update-nightly-version
       - name: Run the build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1dad6d76a..c37646ed7b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,6 +66,12 @@ jobs:
               shell: bash
               forge_platform: linux
     runs-on: ${{ matrix.os.image }}
+    defaults:
+      run:
+        # Under pnpm/action-setup's pnpm 12 bootstrap, `pnpm` invoked from PowerShell on the
+        # win-signing runner exits 0 without running anything, so the steps below have to
+        # reach it through the same shell the build uses.
+        shell: ${{ matrix.os.shell }}
     steps:
       - uses: actions/checkout@v7
         with: