diff --git a/.env b/.env
index 6faaa2b..c5f8d2a 100644
--- a/.env
+++ b/.env
@@ -14,6 +14,12 @@
 # Run "composer dump-env prod" to compile .env files for production use (requires symfony/flex >=1.2).
 # https://symfony.com/doc/current/best_practices.html#use-environment-variables-for-infrastructure-configuration
 
+###> docker / compose (not used by the Symfony app) ###
+# Single source of truth for the npm version baked into the frontend + e2e dev
+# images. Passed to their Dockerfiles via compose build args. Bump here only.
+NPM_VERSION=11.17.0
+###< docker / compose ###
+
 ###> symfony/framework-bundle ###
 APP_ENV=dev
 APP_SECRET=
diff --git a/compose.override.yaml b/compose.override.yaml
index 4ec0910..9728a19 100644
--- a/compose.override.yaml
+++ b/compose.override.yaml
@@ -34,7 +34,12 @@ services:
 
   # Standalone React/Vite SPA (dev only — not in compose.prod.yaml; see #33/#35).
   frontend:
-    image: node:22-alpine
+    # Custom dev image = node:22-alpine with npm pinned (see frontend/Dockerfile.dev).
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile.dev
+      args:
+        NPM_VERSION: ${NPM_VERSION}
     working_dir: /app
     volumes:
       - ./frontend:/app
@@ -43,9 +48,7 @@ services:
       - frontend_node_modules:/app/node_modules
     ports:
       - "${VITE_PORT:-5173}:5173"
-    # Pin npm to the version in package.json's `packageManager` field (the
-    # image's bundled npm is older; corepack doesn't reliably repoint npm).
-    command: sh -c "npm install -g npm@11.17.0 && npm install && npm run dev -- --host 0.0.0.0 --port 5173"
+    command: sh -c "npm install && npm run dev -- --host 0.0.0.0 --port 5173"
     depends_on:
       - php
     environment:
@@ -68,7 +71,12 @@ services:
   # browsers are needed (NixOS host can't run Chromium natively). Image tag is
   # pinned to the @playwright/test version in e2e/package.json — keep in sync.
   playwright:
-    image: mcr.microsoft.com/playwright:v1.49.0-jammy
+    # Custom image = the Playwright image with npm pinned (see e2e/Dockerfile).
+    build:
+      context: ./e2e
+      dockerfile: Dockerfile
+      args:
+        NPM_VERSION: ${NPM_VERSION}
     profiles: [e2e]
     working_dir: /e2e
     volumes:
@@ -81,9 +89,8 @@ services:
       # Wait until Vite is actually serving, not just the container started.
       frontend:
         condition: service_healthy
-    # Pin npm to match package.json's `packageManager`; the image already has
-    # the browsers. Then install deps + run the suite.
-    command: sh -c "npm install -g npm@11.17.0 && npm install && npm test"
+    # npm is pinned in the image (e2e/Dockerfile); just install deps + run.
+    command: sh -c "npm install && npm test"
 
 ###> symfony/mercure-bundle ###
 ###< symfony/mercure-bundle ###
diff --git a/e2e/Dockerfile b/e2e/Dockerfile
new file mode 100644
index 0000000..626c90b
--- /dev/null
+++ b/e2e/Dockerfile
@@ -0,0 +1,12 @@
+# E2E runner: the official Playwright image (browsers + libs preinstalled) with
+# npm pinned to a specific version baked in, so it's not re-fetched per run and
+# doesn't drift with whatever npm the base image happens to ship.
+#
+# The base image tag MUST match @playwright/test in package.json (browsers must
+# match the runner). NPM_VERSION is the single source of truth in the root .env
+# (passed via compose build args) — bump it there, not here.
+FROM mcr.microsoft.com/playwright:v1.49.0-jammy
+
+ARG NPM_VERSION
+RUN npm install -g "npm@${NPM_VERSION}"
+ENV NPM_CONFIG_UPDATE_NOTIFIER=false
diff --git a/e2e/package.json b/e2e/package.json
index 31d1482..96b652d 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,7 +1,6 @@
 {
   "name": "buckets-e2e",
   "private": true,
-  "packageManager": "npm@11.17.0",
   "description": "Playwright end-to-end smoke tests. Runs in the `playwright` compose service (browsers preinstalled) against the live stack, targeting frontend:5173. NOTE: @playwright/test version must match the image tag in compose.override.yaml.",
   "type": "module",
   "scripts": {
diff --git a/frontend/Dockerfile.dev b/frontend/Dockerfile.dev
new file mode 100644
index 0000000..1015a6e
--- /dev/null
+++ b/frontend/Dockerfile.dev
@@ -0,0 +1,11 @@
+# Dev image for the Vite SPA: node:22-alpine with npm pinned to a specific
+# version baked in, so it's not re-installed on every container start and
+# doesn't drift with whatever npm the base image happens to ship.
+#
+# NPM_VERSION is the single source of truth in the root .env (passed via compose
+# build args). Bump it there, not here.
+FROM node:22-alpine
+
+ARG NPM_VERSION
+RUN npm install -g "npm@${NPM_VERSION}"
+ENV NPM_CONFIG_UPDATE_NOTIFIER=false
diff --git a/frontend/package.json b/frontend/package.json
index 16af35c..b84a714 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -3,7 +3,6 @@
   "private": true,
   "version": "0.0.0",
   "type": "module",
-  "packageManager": "npm@11.17.0",
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",