diff --git a/.github/workflows/plugins-deploy-api-doc.yml b/.github/workflows/plugins-deploy-api-doc.yml
index a3598af4bd..4d0e5754d2 100644
--- a/.github/workflows/plugins-deploy-api-doc.yml
+++ b/.github/workflows/plugins-deploy-api-doc.yml
@@ -45,7 +45,8 @@ jobs:
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 
-      # START: Setup Node and PNPM enabling cache
+      # No dependency cache here: a deploy must not restore a cache that
+      # other workflows can write to.
       - name: Setup pnpm + Node.js
         uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
         with:
@@ -53,26 +54,11 @@ jobs:
           runtime: node@24.21.0
           install: false
 
-      - name: Get pnpm store path
-        id: pnpm-store
-        working-directory: ./plugins
-        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('plugins/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-      # END: Setup Node and PNPM enabling cache
-
       - name: Install deps
         working-directory: ./plugins
         shell: bash
         run: |
-          pnpm install --no-frozen-lockfile;
+          pnpm install --frozen-lockfile;
           pnpm add -D -w wrangler@latest;
 
       - name: Build docs
diff --git a/.github/workflows/plugins-deploy-package.yml b/.github/workflows/plugins-deploy-package.yml
index 7c83df9f5d..6165dd465b 100644
--- a/.github/workflows/plugins-deploy-package.yml
+++ b/.github/workflows/plugins-deploy-package.yml
@@ -75,7 +75,7 @@ jobs:
         working-directory: ./plugins
         shell: bash
         run: |
-          pnpm install --no-frozen-lockfile;
+          pnpm install --frozen-lockfile;
           pnpm add -D -w wrangler@latest;
 
       - name: "Build package for ${{ inputs.plugin_name }}-plugin"
diff --git a/.github/workflows/plugins-deploy-styles-doc.yml b/.github/workflows/plugins-deploy-styles-doc.yml
index 3c04eb6b58..0f04b62615 100644
--- a/.github/workflows/plugins-deploy-styles-doc.yml
+++ b/.github/workflows/plugins-deploy-styles-doc.yml
@@ -43,7 +43,8 @@ jobs:
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 
-      # START: Setup Node and PNPM enabling cache
+      # No dependency cache here: a deploy must not restore a cache that
+      # other workflows can write to.
       - name: Setup pnpm + Node.js
         uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
         with:
@@ -51,26 +52,11 @@ jobs:
           runtime: node@24.21.0
           install: false
 
-      - name: Get pnpm store path
-        id: pnpm-store
-        working-directory: ./plugins
-        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('plugins/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-      # END: Setup Node and PNPM enabling cache
-
       - name: Install deps
         working-directory: ./plugins
         shell: bash
         run: |
-          pnpm install --no-frozen-lockfile;
+          pnpm install --frozen-lockfile;
           pnpm add -D -w wrangler@latest;
 
       - name: Build styles
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 645e3764d8..b50d0fdffd 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -12,11 +12,6 @@ rules:
       - plugins-deploy-api-doc.yml
       - plugins-deploy-package.yml
       - plugins-deploy-styles-doc.yml
-  # Avoid restoring caches in release/publish workflows.
-  cache-poisoning:
-    ignore:
-      - plugins-deploy-api-doc.yml
-      - plugins-deploy-styles-doc.yml
   # Review `pull_request_target` usage.
   dangerous-triggers:
     ignore: