diff --git a/scripts/g14-gitops-render.mjs b/scripts/g14-gitops-render.mjs
index f1278ac1..1299b9b9 100644
--- a/scripts/g14-gitops-render.mjs
+++ b/scripts/g14-gitops-render.mjs
@@ -1484,6 +1484,22 @@ function prepareSourceScript() {
     "test \"$(git rev-parse HEAD)\" = \"$(params.revision)\"",
     "git merge-base --is-ancestor \"$(params.revision)\" \"origin/$(params.source-branch)\" || { echo '{\"event\":\"source-ancestry\",\"status\":\"failed\",\"revision\":\"'\"$(params.revision)\"'\",\"sourceBranch\":\"'\"$(params.source-branch)\"'\"}'; exit 32; }",
     "ci_timing_emit source-clone succeeded \"$source_clone_started_ms\"",
+    "prepare_source_dependencies_started_ms=\"$(ci_now_ms)\"",
+    "if node -e 'require.resolve(\"yaml\")' >/dev/null 2>&1; then",
+    "  echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"cached\",\"dependency\":\"yaml\"}'",
+    "elif [ -f package-lock.json ]; then",
+    "  command -v npm >/dev/null 2>&1 || { echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"failed\",\"reason\":\"missing-tool\",\"tool\":\"npm\"}'; exit 31; }",
+    "  npm ci --ignore-scripts --no-audit --prefer-offline",
+    "  echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"installed\",\"manager\":\"npm\",\"dependency\":\"yaml\"}'",
+    "elif [ -f bun.lock ] || [ -f bun.lockb ]; then",
+    "  command -v bun >/dev/null 2>&1 || { echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"failed\",\"reason\":\"missing-tool\",\"tool\":\"bun\"}'; exit 31; }",
+    "  bun install --frozen-lockfile --ignore-scripts",
+    "  echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"installed\",\"manager\":\"bun\",\"dependency\":\"yaml\"}'",
+    "else",
+    "  echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"failed\",\"reason\":\"lockfile-missing\",\"dependency\":\"yaml\"}'",
+    "  exit 33",
+    "fi",
+    "ci_timing_emit prepare-source-dependencies succeeded \"$prepare_source_dependencies_started_ms\"",
     "catalog_path=\"$(params.catalog-path)\"",
     "mkdir -p \"$(dirname \"$catalog_path\")\"",
     "catalog_fetch_started_ms=\"$(ci_now_ms)\"",
@@ -1535,7 +1551,6 @@ function prepareSourceScript() {
     "  echo '{\"event\":\"gitops-artifact-catalog\",\"phase\":\"prepare-source\",\"status\":\"seeded-v02-skeleton\"}'",
     "fi",
     "ci_timing_emit catalog-fetch succeeded \"$catalog_fetch_started_ms\"",
-    "echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"skipped\",\"reason\":\"ci-tools-image-provides-required-node-runtime\"}'",
     `echo ${shellSingleQuote(`G14 prepare-source complete; validation task count=${primitiveValidationTasks.length}`)}`
   ];
   return `${lines.join("\n")}\n`;
diff --git a/scripts/g14-gitops-render.test.ts b/scripts/g14-gitops-render.test.ts
index bc37b208..cc664eac 100644
--- a/scripts/g14-gitops-render.test.ts
+++ b/scripts/g14-gitops-render.test.ts
@@ -174,7 +174,10 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
     assert.match(prepareSourceScript, /git_timed catalog-ls-remote 45 git ls-remote --exit-code --heads "\$git_read_url"/u);
     assert.match(prepareSourceScript, /git remote set-url gitops-catalog "\$git_read_url"/u);
     assert.match(prepareSourceScript, /prepare-source-dependencies/u);
-    assert.doesNotMatch(prepareSourceScript, /npm ci --ignore-scripts/u);
+    assert.match(prepareSourceScript, /require\.resolve\("yaml"\)/u);
+    assert.match(prepareSourceScript, /npm ci --ignore-scripts --no-audit --prefer-offline/u);
+    assert.match(prepareSourceScript, /bun install --frozen-lockfile --ignore-scripts/u);
+    assert.doesNotMatch(prepareSourceScript, /ci-tools-image-provides-required-node-runtime/u);
     assert.doesNotMatch(prepareSourceScript, /prepare-source-pre-npm/u);
     assert.doesNotMatch(prepareSourceScript, /prepare-source-proxy-preflight/u);
     assert.doesNotMatch(prepareSourceScript, /dependency-curl-probe-start/u);