diff --git a/Dockerfile.ci b/Dockerfile.ci
index bc3ef1930a..569a6add5c 100644
--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -3,9 +3,15 @@ FROM docker.io/library/node:22-alpine AS builder
 WORKDIR /src
 COPY . ./
 RUN apk add --no-cache python3 py3-setuptools make g++ git
-# Install the pnpm version pinned in package.json `packageManager` via npm;
-# corepack was removed from Node 25+ and cannot install pnpm >= 12.
-RUN npm install --global pnpm@$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]") && \
+# Install the pnpm version pinned in package.json `packageManager`, verifying
+# the tarball against the pin's sha512 digest as corepack did (corepack was
+# removed from Node 25+ and cannot install pnpm >= 12).
+RUN pnpm_version=$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]") && \
+    pnpm_sha=$(node -p "require('./package.json').packageManager.split('+sha512.')[1]") && \
+    npm pack pnpm@$pnpm_version && \
+    echo "$pnpm_sha  pnpm-$pnpm_version.tgz" | sha512sum -c - && \
+    npm install --global ./pnpm-$pnpm_version.tgz && \
+    rm ./pnpm-$pnpm_version.tgz && \
     pnpm install --frozen-lockfile && \
     pnpm run build && \
     # Commit lint CLI packages