diff --git a/.github/scripts/tests/lockfile-refresh-workflows.test.mjs b/.github/scripts/tests/lockfile-refresh-workflows.test.mjs
new file mode 100644
index 00000000000..52fef1f698d
--- /dev/null
+++ b/.github/scripts/tests/lockfile-refresh-workflows.test.mjs
@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+const workflows = [
+  '.github/workflows/refresh-lockfile.yml',
+  '.github/workflows/pr-trusted.yml',
+  '.github/workflows/docker.yml',
+];
+
+test('lockfile repair workflows resolve dependencies instead of updating metadata only', async () => {
+  for (const workflow of workflows) {
+    const contents = await readFile(workflow, 'utf8');
+    const repairCommands = contents
+      .split('\n')
+      .filter((line) => line.includes('pnpm install') && line.includes('--no-frozen-lockfile'));
+
+    assert.ok(repairCommands.length > 0, `${workflow} must contain a lockfile repair command`);
+    for (const command of repairCommands) {
+      assert.match(command, /--ignore-scripts/);
+      assert.doesNotMatch(command, /--lockfile-only/);
+    }
+  }
+});
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 14b8937abe4..5fb9f7e6005 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -87,7 +87,7 @@ jobs:
       - name: Refresh lockfile for Docker build context
         run: |
           set -euo pipefail
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then
@@ -281,7 +281,7 @@ jobs:
       - name: Refresh lockfile for Docker build context
         run: |
           set -euo pipefail
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then
diff --git a/.github/workflows/pr-trusted.yml b/.github/workflows/pr-trusted.yml
index 5bc040f992f..7bd403aa571 100644
--- a/.github/workflows/pr-trusted.yml
+++ b/.github/workflows/pr-trusted.yml
@@ -337,7 +337,7 @@ jobs:
         id: regen_lockfile
         run: |
           cp pnpm-lock.yaml "$RUNNER_TEMP/pnpm-lock.before.yaml"
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
           if cmp -s "$RUNNER_TEMP/pnpm-lock.before.yaml" pnpm-lock.yaml; then
             echo "regenerated=0" >> "$GITHUB_OUTPUT"
           else
diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml
index 49ac2176e7f..039d21970e0 100644
--- a/.github/workflows/refresh-lockfile.yml
+++ b/.github/workflows/refresh-lockfile.yml
@@ -35,7 +35,7 @@ jobs:
           cache: pnpm
 
       - name: Refresh pnpm lockfile
-        run: pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+        run: pnpm install --ignore-scripts --no-frozen-lockfile
 
       - name: Fail on unexpected file changes
         run: |