diff --git a/.npmrc b/.npmrc
index 7a4a3138..90668dc7 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,4 +1,5 @@
 # Ensure reproducible local validation: always install devDependencies.
 # Overrides global `omit=dev` so `npm ci` installs everything needed
 # for `npm run typecheck` and `npm run test` to work from a clean checkout.
+# CAUTION: include=dev overrides --omit=dev (npm config precedence), which is why scripts.audit passes an explicit --include=prod. See package.json "//".audit, SECURITY-ACCEPTED-RISKS.md, and #1166.
 include=dev