diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index fe40c3be7..83f98222d 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -9,6 +9,11 @@ minimumReleaseAgeExclude:
   - '@commercetools-backend/*'
   - '@commercetools-uikit/*'
 
+# Explicit minimumReleaseAge already makes pnpm hard-fail on a no-mature-match; true keeps that (no silent fall-back or auto-exclude).
+minimumReleaseAgeStrict: true
+# Deliberate tightening: enforce the gate even when registry metadata omits a publish time, so a time-less mirror can't waive the cooldown.
+minimumReleaseAgeIgnoreMissingTime: false
+
 blockExoticSubdeps: true
 
 allowBuilds: