diff --git a/compose.override.yaml b/compose.override.yaml
index 49ef1bd..4ec0910 100644
--- a/compose.override.yaml
+++ b/compose.override.yaml
@@ -43,12 +43,23 @@ services:
       - frontend_node_modules:/app/node_modules
     ports:
       - "${VITE_PORT:-5173}:5173"
-    command: sh -c "npm install && npm run dev -- --host 0.0.0.0 --port 5173"
+    # Pin npm to the version in package.json's `packageManager` field (the
+    # image's bundled npm is older; corepack doesn't reliably repoint npm).
+    command: sh -c "npm install -g npm@11.17.0 && npm install && npm run dev -- --host 0.0.0.0 --port 5173"
     depends_on:
       - php
     environment:
       # Reliable file-watching under the bind-mount.
       CHOKIDAR_USEPOLLING: "true"
+    # Marks the service healthy only once Vite is actually serving — the e2e
+    # runner waits on this (condition: service_healthy) to avoid racing startup.
+    # start_period covers the slow first boot (global npm install + npm install).
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:5173/"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 90s
     tty: true
 
   # Playwright e2e runner (browsers + libs preinstalled). On-demand only — opt
@@ -67,9 +78,12 @@ services:
       # Target the SPA by compose service name, not localhost.
       E2E_BASE_URL: "http://frontend:5173"
     depends_on:
-      - frontend
-    # Install deps then run the suite; the image already has the browsers.
-    command: sh -c "npm install && npm test"
+      # Wait until Vite is actually serving, not just the container started.
+      frontend:
+        condition: service_healthy
+    # Pin npm to match package.json's `packageManager`; the image already has
+    # the browsers. Then install deps + run the suite.
+    command: sh -c "npm install -g npm@11.17.0 && npm install && npm test"
 
 ###> symfony/mercure-bundle ###
 ###< symfony/mercure-bundle ###
diff --git a/e2e/package.json b/e2e/package.json
index 96b652d..31d1482 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,6 +1,7 @@
 {
   "name": "buckets-e2e",
   "private": true,
+  "packageManager": "npm@11.17.0",
   "description": "Playwright end-to-end smoke tests. Runs in the `playwright` compose service (browsers preinstalled) against the live stack, targeting frontend:5173. NOTE: @playwright/test version must match the image tag in compose.override.yaml.",
   "type": "module",
   "scripts": {
diff --git a/frontend/package.json b/frontend/package.json
index b84a714..16af35c 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -3,6 +3,7 @@
   "private": true,
   "version": "0.0.0",
   "type": "module",
+  "packageManager": "npm@11.17.0",
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",