diff --git a/bunfig.toml b/bunfig.toml
index 27722f016f1..791be5f6eff 100644
--- a/bunfig.toml
+++ b/bunfig.toml
@@ -1,6 +1,17 @@
 [install]
 exact = true
-minimumReleaseAge = 0
+# Supply-chain gate: only install package versions published at least 7 days ago
+# (blocks freshly published, potentially compromised releases).
+minimumReleaseAge = 604800
+# @typescript/native-preview stays excluded permanently: it only publishes nightly
+# dev builds, so every version is structurally younger than any age gate.
+# typescript@7.0.2 and @typescript/typescript6@6.0.2 were vetted in #5521; they age
+# out of the gate on 2026-07-15 and 2026-07-13 — drop those two entries after that.
+minimumReleaseAgeExcludes = [
+  "typescript",
+  "@typescript/typescript6",
+  "@typescript/native-preview",
+]
 
 [run]
 env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }