diff --git a/.changeset/chilled-spiders-drive.md b/.changeset/chilled-spiders-drive.md
new file mode 100644
index 000000000..65a918934
--- /dev/null
+++ b/.changeset/chilled-spiders-drive.md
@@ -0,0 +1,7 @@
+---
+'skuba': patch
+---
+
+lint: Avoid committing `.npmrc` changes
+
+`skuba lint` can automatically commit codegen changes if you have [GitHub autofixes](https://seek-oss.github.io/skuba/docs/deep-dives/github.html#github-autofixes) enabled on your project. Previously we made sure to exclude a new `.npmrc` file from the commit, but we now exclude changes to an existing `.npmrc` too.
diff --git a/src/cli/lint/autofix.test.ts b/src/cli/lint/autofix.test.ts
index dae5613cd..521d9d86b 100644
--- a/src/cli/lint/autofix.test.ts
+++ b/src/cli/lint/autofix.test.ts
@@ -496,6 +496,21 @@ describe('autofix', () => {
       `);
     });
 
+    it('skips an .npmrc modification only', async () => {
+      jest.spyOn(Git, 'getChangedFiles').mockResolvedValue([
+        {
+          path: '.npmrc',
+          state: 'modified',
+        },
+      ]);
+
+      await expect(
+        autofix({ ...params, eslint: false, prettier: false }),
+      ).resolves.toBeUndefined();
+
+      expectNoAutofix();
+    });
+
     it('handles codegen changes only', async () => {
       jest.spyOn(Git, 'getChangedFiles').mockResolvedValue([
         {
diff --git a/src/cli/lint/autofix.ts b/src/cli/lint/autofix.ts
index 1e6fc281e..631a452fd 100644
--- a/src/cli/lint/autofix.ts
+++ b/src/cli/lint/autofix.ts
@@ -39,6 +39,12 @@ export const AUTOFIX_IGNORE_FILES: Git.ChangedFile[] = [
     path: '.npmrc',
     state: 'added',
   },
+  {
+    // This file may already exist in version control, but we shouldn't commit
+    // further changes as the CI environment may have appended an npm token.
+    path: '.npmrc',
+    state: 'modified',
+  },
   {
     path: 'Dockerfile-incunabulum',
     state: 'added',