diff --git a/src/frontend/.npmrc b/src/frontend/.npmrc
new file mode 100644
index 0000000..7605a9c
--- /dev/null
+++ b/src/frontend/.npmrc
@@ -0,0 +1,11 @@
+# Pin the public npm registry explicitly.
+#
+# Dependabot's npm updater sources the registry from a committed .npmrc (or a
+# `registries:` block in dependabot.yml). With neither present it refused to
+# rebase/recreate every frontend PR with "can't access a private package
+# registry without explicit configuration" (#67), even though every dependency
+# resolves from public npm. This file is that explicit configuration.
+#
+# No auth token here (the registry is public) — tokens belong in Dependabot
+# secrets, never in the repo.
+registry=https://registry.npmjs.org/