diff --git a/packages/pwa-kit-create-app/CHANGELOG.md b/packages/pwa-kit-create-app/CHANGELOG.md
index 812428f8a2..01cda6bb27 100644
--- a/packages/pwa-kit-create-app/CHANGELOG.md
+++ b/packages/pwa-kit-create-app/CHANGELOG.md
@@ -1,3 +1,6 @@
+## v3.22.0-dev
+- [Bugfix] Temporarily pin transitive Vitest to 4.1.11 in the create-app package and generated extensible apps to avoid an npm 10 dependency resolver crash while the Vitest browser packages require 4.1.11.
+
 ## v3.21.0 (Oct 08, 2026)
 - [Bugfix] Keep the generated `ssr.js.hbs` templates in sync with `template-retail-react-app` for Commerce Client image upload (`cc_enableImageUpload`): add `blob:` and `data:` to `img-src` in both SSR template variants so the widget's image preview and sent-image thumbnail are not blocked by CSP in generated projects. [#4053](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4053)
 - Keep the generated `ssr.js.hbs` templates in sync with `template-retail-react-app` for the `dw_attribution` first-touch marketing-attribution cookie (W-23493129): both SSR template variants now import `createAttributionCookieMiddleware`, construct it with the configured `cookieDomain`, and mount it on the catch-all render route, so generated projects write the attribution cookie instead of shipping the utility as dead code.
diff --git a/packages/pwa-kit-create-app/assets/bootstrap/js/package.json.hbs b/packages/pwa-kit-create-app/assets/bootstrap/js/package.json.hbs
index b829bc24e7..86379c92a3 100644
--- a/packages/pwa-kit-create-app/assets/bootstrap/js/package.json.hbs
+++ b/packages/pwa-kit-create-app/assets/bootstrap/js/package.json.hbs
@@ -19,6 +19,7 @@
     {{/each}}
   },
   "overrides": {
+    "vitest": "4.1.11",
     "react-router": {
       "path-to-regexp": "^1.9.0"
     },
@@ -43,4 +44,4 @@
     "Android >= 4.4.4",
     "last 4 ChromeAndroid versions"
   ]
-}
\ No newline at end of file
+}
diff --git a/packages/pwa-kit-create-app/package.json b/packages/pwa-kit-create-app/package.json
index 8e8e5c3de6..5dfd0e9fb6 100644
--- a/packages/pwa-kit-create-app/package.json
+++ b/packages/pwa-kit-create-app/package.json
@@ -43,6 +43,9 @@
     "internal-lib-build": "3.22.0-dev",
     "verdaccio": "^5.22.1"
   },
+  "overrides": {
+    "vitest": "4.1.11"
+  },
   "engines": {
     "node": "^18.0.0 || ^20.0.0 || ^22.0.0 || ^24.0.0",
     "npm": "^9.0.0 || ^10.0.0 || ^11.0.0"
diff --git a/packages/template-retail-react-app/CHANGELOG.md b/packages/template-retail-react-app/CHANGELOG.md
index a9835b0340..ecc390887e 100644
--- a/packages/template-retail-react-app/CHANGELOG.md
+++ b/packages/template-retail-react-app/CHANGELOG.md
@@ -1,4 +1,5 @@
 ## v10.4.0-dev (Oct 09, 2026)
+- [Bugfix] Temporarily pin transitive Vitest to 4.1.11 to avoid an npm 10 dependency resolver crash during fresh installs while the Vitest browser packages require 4.1.11.
 - [Bugfix] Fix `useScript` remount when the script tag is already in the DOM. ShopperAgent (and other consumers) stayed at `loaded: false` after a remount because the existing tag never fired `load` again, so the Commerce Client widget did not re-inject. The hook now stamps `data-script-status` on load/error and only reports `loaded: true` when that status is `ready`; an in-flight tag stays unloaded until it finishes. [#4062](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4062) (W-24380725)
 - [Bugfix] Route Commerce Client widget product/checkout/markdown clicks through the storefront `useNavigation` router via the widget's `onNavigate` callback, so same-tab same-origin links stay in the SPA instead of triggering a full page load. Requires Commerce Client widget `1.48.0+`. `cc_openLinksInNewTab: "true"` is unchanged and still opens a new tab. Also fixes `buildUrl` (`createUrlTemplate`) when site/locale are configured as `query_param`: paths that already have a query string or hash now get site/locale merged into the existing query instead of a second `?` appended (which previously corrupted params like `q`/`pid` and swallowed the hash).
 - [Enhancement] Update inline agent widget UMD bundle: replace the text-prefix product-context hack with the proper SCRT2 v2 session-context API. Product context is now sent as a `commerce_agent_context` StructuredValue in the SessionContextSet envelope, leaving the shopper's message text unchanged. Default `capabilitiesVersion` bumped to `"65"`. Built from [inline-agent-widget#3](https://github.com/SalesforceCommerceCloud/inline-agent-widget/pull/3). [#4054](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/4054)
diff --git a/packages/template-retail-react-app/package.json b/packages/template-retail-react-app/package.json
index 4490628981..20ecc92319 100644
--- a/packages/template-retail-react-app/package.json
+++ b/packages/template-retail-react-app/package.json
@@ -92,6 +92,7 @@
     "cross-env": "^5.2.1"
   },
   "overrides": {
+    "vitest": "4.1.11",
     "react-router": {
       "path-to-regexp": "^1.9.0"
     },