diff --git a/.github/workflows/plugin-npm-release.yml b/.github/workflows/plugin-npm-release.yml
index 78c6e66bca68..7fa92d412124 100644
--- a/.github/workflows/plugin-npm-release.yml
+++ b/.github/workflows/plugin-npm-release.yml
@@ -9,6 +9,7 @@ on:
       - ".github/workflows/plugin-npm-release.yml"
       - "extensions/**"
       - "package.json"
+      - "scripts/generate-npm-package-lock.mjs"
       - "scripts/lib/npm-publish-plan.mjs"
       - "scripts/lib/release-version.mjs"
       - "scripts/lib/plugin-npm-package-manifest.mjs"
@@ -335,12 +336,17 @@ jobs:
           ref: ${{ github.workflow_sha }}
           path: .release-tooling
           fetch-depth: 1
-          sparse-checkout: scripts/lib/plugin-npm-package-manifest.mjs
+          sparse-checkout: |
+            scripts/generate-npm-package-lock.mjs
+            scripts/lib/plugin-npm-package-manifest.mjs
           sparse-checkout-cone-mode: false
 
       - name: Overlay trusted packaging helper
         run: |
           set -euo pipefail
+          cp \
+            .release-tooling/scripts/generate-npm-package-lock.mjs \
+            scripts/generate-npm-package-lock.mjs
           cp \
             .release-tooling/scripts/lib/plugin-npm-package-manifest.mjs \
             scripts/lib/plugin-npm-package-manifest.mjs
@@ -1229,6 +1235,9 @@ jobs:
         if: steps.publication_evidence.outputs.publish_route == 'npm-oidc'
         run: |
           set -euo pipefail
+          cp \
+            scripts/generate-npm-package-lock.mjs \
+            .publication-target/scripts/generate-npm-package-lock.mjs
           cp \
             scripts/lib/plugin-npm-package-manifest.mjs \
             .publication-target/scripts/lib/plugin-npm-package-manifest.mjs
diff --git a/test/scripts/plugin-npm-extended-stable-workflow.test.ts b/test/scripts/plugin-npm-extended-stable-workflow.test.ts
index 80c62d9dfadb..923638f3365a 100644
--- a/test/scripts/plugin-npm-extended-stable-workflow.test.ts
+++ b/test/scripts/plugin-npm-extended-stable-workflow.test.ts
@@ -105,6 +105,33 @@ describe("plugin npm extended-stable workflow", () => {
     }
   });
 
+  it("overlays the complete trusted packaging helper dependency pair", () => {
+    const parsed = workflow();
+    const preflightCheckout = step(
+      parsed.jobs?.preview_plugin_pack,
+      "Checkout trusted packaging helper",
+    );
+    expect(preflightCheckout.with?.["sparse-checkout"]).toContain(
+      "scripts/generate-npm-package-lock.mjs",
+    );
+    expect(preflightCheckout.with?.["sparse-checkout"]).toContain(
+      "scripts/lib/plugin-npm-package-manifest.mjs",
+    );
+
+    const expectedCopies = [
+      "scripts/generate-npm-package-lock.mjs",
+      "scripts/lib/plugin-npm-package-manifest.mjs",
+    ];
+    for (const helperPath of expectedCopies) {
+      expect(
+        step(parsed.jobs?.preview_plugin_pack, "Overlay trusted packaging helper").run,
+      ).toContain(helperPath);
+      expect(
+        step(parsed.jobs?.publish_plugins_npm, "Overlay trusted OIDC packaging helper").run,
+      ).toContain(helperPath);
+    }
+  });
+
   it("trusts only the canonical monthly branch at the exact checked-out SHA", () => {
     const trusted = step(
       workflow().jobs?.preview_plugins_npm,
@@ -404,7 +431,6 @@ describe("plugin npm extended-stable workflow", () => {
     ).toMatchObject({
       ref: "${{ github.workflow_sha }}",
       path: ".release-tooling",
-      "sparse-checkout": "scripts/lib/plugin-npm-package-manifest.mjs",
     });
     expect(
       step(parsed.jobs?.preview_plugin_pack, "Overlay trusted packaging helper").run,