diff --git a/.github/workflows/pr-trusted.yml b/.github/workflows/pr-trusted.yml
index 18246ba0de7..d3305f0d2b4 100644
--- a/.github/workflows/pr-trusted.yml
+++ b/.github/workflows/pr-trusted.yml
@@ -58,8 +58,21 @@ jobs:
           else
             echo 'enabled=false' >> "$GITHUB_OUTPUT"
           fi
-      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
+      # Same trusted bootstrap as every other pnpm setup in this workflow:
+      # Node immediately first, and no npm audit, fund or update-notifier calls.
+      - name: Setup Node.js for pnpm bootstrap
         if: steps.eligible.outputs.enabled == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - name: Setup pnpm
+        if: steps.eligible.outputs.enabled == 'true'
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        env:
+          NPM_CONFIG_AUDIT: "false"
+          NPM_CONFIG_FUND: "false"
+          NPM_CONFIG_UPDATE_NOTIFIER: "false"
         with:
           version: 9.15.4
       - name: Restore dependencies for graph analysis
diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts
index ca84b9de5ab..45da5567773 100644
--- a/tests/runner-e2e/workflow-security.test.ts
+++ b/tests/runner-e2e/workflow-security.test.ts
@@ -82,11 +82,14 @@ describe("public repository paid workflow security", () => {
     );
   });
 
+  // PR #18348 added the ninth pr-trusted bootstrap, in the Vitest selection job.
+  const trustedPnpmBootstraps = {
+    "runner-full-stack-e2e.yml": 8,
+    "pr-trusted.yml": 9,
+  } as const;
+
   it("keeps pnpm bootstrap registry telemetry out of trusted workflow setup", async () => {
-    for (const workflowName of [
-      "runner-full-stack-e2e.yml",
-      "pr-trusted.yml",
-    ]) {
+    for (const workflowName of Object.keys(trustedPnpmBootstraps) as Array<keyof typeof trustedPnpmBootstraps>) {
       const workflow = await readFile(
         path.join(repositoryRoot, ".github/workflows", workflowName),
         "utf8",
@@ -95,7 +98,7 @@ describe("public repository paid workflow security", () => {
         .split(/\n(?= {6}- )/u)
         .filter((step) => step.includes("uses: pnpm/action-setup@"));
 
-      expect(pnpmSetupSteps, workflowName).toHaveLength(8);
+      expect(pnpmSetupSteps, workflowName).toHaveLength(trustedPnpmBootstraps[workflowName]);
       for (const step of pnpmSetupSteps) {
         expect(step, workflowName).toContain('NPM_CONFIG_AUDIT: "false"');
         expect(step, workflowName).toContain('NPM_CONFIG_FUND: "false"');
@@ -139,7 +142,7 @@ describe("public repository paid workflow security", () => {
         step.includes("uses: pnpm/action-setup@") ? [index] : [],
       );
 
-      expect(pnpmSetupStepIndexes, name).toHaveLength(8);
+      expect(pnpmSetupStepIndexes, name).toHaveLength(trustedPnpmBootstraps[name as keyof typeof trustedPnpmBootstraps]);
       for (const pnpmSetupStepIndex of pnpmSetupStepIndexes) {
         const pnpmSetupStep = steps[pnpmSetupStepIndex]!;
         const nodeBootstrapStep = steps[pnpmSetupStepIndex - 1]!;