diff --git a/.github/workflows/renovate-config-validator.yml b/.github/workflows/renovate-config-validator.yml
index 33d5f50..b592d59 100644
--- a/.github/workflows/renovate-config-validator.yml
+++ b/.github/workflows/renovate-config-validator.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
 
@@ -58,7 +58,15 @@ jobs:
             echo "No Renovate config or preset files found to validate." >&2
             exit 1
           fi
+          # Resolve to absolute paths, then validate from an isolated working
+          # directory so the repository's own package.json (engines/devEngines)
+          # cannot block npm.
+          ABS=""
+          for f in ${FILES}; do
+            ABS="${ABS} $(realpath "$f")"
+          done
           echo "Validating:"
-          printf '  %s\n' ${FILES}
+          printf '  %s\n' ${ABS}
+          cd "$(mktemp -d)"
           # shellcheck disable=SC2086 -- intentional word-splitting of the file list
-          npx --yes --ignore-scripts --package renovate -- renovate-config-validator --strict ${FILES}
+          npx --yes --ignore-scripts --package renovate -- renovate-config-validator --strict ${ABS}