diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml
index 19cc78748d..96c0fcfde8 100644
--- a/.github/workflows/benchmark.yaml
+++ b/.github/workflows/benchmark.yaml
@@ -151,6 +151,7 @@ jobs:
       - name: Run Benchmarks variations
         env:
           CODEARTIFACT_AUTH_TOKEN: ${{ steps.aws.outputs.token }}
+          VLT_REGISTRY_URL: ${{ secrets.VLT_REGISTRY_URL }}
           VLT_REGISTRY_AUTH_TOKEN: ${{ secrets.VLT_REGISTRY_AUTH_TOKEN }}
           GH_REGISTRY: ${{ secrets.GH_REGISTRY }}
           GH_AUTH_TOKEN: ${{ secrets.GH_AUTH_TOKEN }}
diff --git a/scripts/clean-helpers.sh b/scripts/clean-helpers.sh
index b67640da60..8971d24a74 100644
--- a/scripts/clean-helpers.sh
+++ b/scripts/clean-helpers.sh
@@ -226,6 +226,7 @@ clean_all() {
   clean_all_cache
   clean_build_files
   clean_build_output
+  clean_npmrc
   echo "Cleanup completed successfully!"
 }
 
diff --git a/scripts/setup-vlt-registry.sh b/scripts/setup-vlt-registry.sh
new file mode 100755
index 0000000000..56b54f17bf
--- /dev/null
+++ b/scripts/setup-vlt-registry.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Write vlt registry config to .npmrc (project-level).
+# Preserves existing non-registry lines (e.g. engine-strict=true).
+# No-op when VLT_REGISTRY_URL or VLT_REGISTRY_AUTH_TOKEN is not available.
+#
+# Usage: bash setup-vlt-registry.sh
+#
+# Required env vars:
+#   VLT_REGISTRY_URL        — registry URL (e.g. https://registry.vlt.io/vlt/npm/)
+#   VLT_REGISTRY_AUTH_TOKEN  — auth token for the vlt registry
+#
+# The script is idempotent: it strips any previous registry/auth lines
+# before appending the vlt registry config.
+
+set -euo pipefail
+
+REGISTRY_URL="${VLT_REGISTRY_URL:-}"
+AUTH_TOKEN="${VLT_REGISTRY_AUTH_TOKEN:-}"
+
+if [ -z "$REGISTRY_URL" ] || [ -z "$AUTH_TOKEN" ]; then
+  exit 0
+fi
+
+REGISTRY_NPMRC_KEY="${REGISTRY_URL#http*://}"
+
+# Strip any previous registry/auth lines, then append ours
+if [ -f ".npmrc" ]; then
+  awk '!/^[[:space:]]*(registry=|\/\/)/ { print }' ".npmrc" > ".npmrc.tmp"
+  mv ".npmrc.tmp" ".npmrc"
+fi
+
+{
+  echo "registry=${REGISTRY_URL}"
+  echo "//${REGISTRY_NPMRC_KEY}:_authToken=\${VLT_REGISTRY_AUTH_TOKEN}"
+} >> ".npmrc"
diff --git a/scripts/setup.sh b/scripts/setup.sh
index a0528cc8ed..9923a18fd9 100644
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -50,8 +50,12 @@ npm install -g npm@latest corepack@latest vlt@latest bun@latest deno@latest nx@l
 # Install Vite+ (vp) via npm (available as the `vite-plus` package)
 npm install -g vite-plus@latest
 
-# Install aube via npm (available as the `@endevco/aube` package)
-npm install -g @endevco/aube@latest
+# Install aube via npm (available as the `@endevco/aube` package).
+# Non-fatal: aube may not have a working binary for all platforms (e.g. arm64).
+# If it fails to install, the benchmark suite continues without aube.
+if ! npm install -g @endevco/aube@latest 2>/dev/null; then
+  echo "Warning: aube installation failed (may not support this platform) — skipping aube benchmarks"
+fi
 
 # Configure Package Managers
 echo "Configuring package managers..."
diff --git a/scripts/variations/common.sh b/scripts/variations/common.sh
index 86f19092d7..fc5499f79d 100644
--- a/scripts/variations/common.sh
+++ b/scripts/variations/common.sh
@@ -56,31 +56,83 @@ for pm in npm yarn berry zpm pnpm pacquet vlt bun deno aube nx turbo vp node; do
   fi
 done
 BENCH_OUTPUT_FOLDER="$BENCH_RESULTS/$BENCH_FIXTURE/$BENCH_VARIATION"
+
+# ---------------------------------------------------------------------------
+# Default registry: vlt registry
+# All non-registry benchmark variations use the vlt registry instead of the
+# public npm registry.  This requires both VLT_REGISTRY_URL and
+# VLT_REGISTRY_AUTH_TOKEN to be set (configured as GitHub secrets).
+# The URL and token must match — the token authenticates requests to the
+# specific registry URL.
+# When either is absent (e.g. local development) the default npm registry
+# is used as a fallback.
+# ---------------------------------------------------------------------------
+BENCH_DEFAULT_REGISTRY_URL="${VLT_REGISTRY_URL:-}"
+
+if [ -n "${VLT_REGISTRY_AUTH_TOKEN:-}" ] && [ -n "$BENCH_DEFAULT_REGISTRY_URL" ]; then
+  BENCH_USE_VLT_REGISTRY=1
+  BENCH_DEFAULT_REGISTRY_NPMRC_KEY="${BENCH_DEFAULT_REGISTRY_URL#http*://}"
+  echo "Using vlt registry as default: $BENCH_DEFAULT_REGISTRY_URL"
+else
+  BENCH_USE_VLT_REGISTRY=""
+  BENCH_DEFAULT_REGISTRY_NPMRC_KEY=""
+  if [ -n "${VLT_REGISTRY_AUTH_TOKEN:-}" ] && [ -z "$BENCH_DEFAULT_REGISTRY_URL" ]; then
+    echo "Warning: VLT_REGISTRY_AUTH_TOKEN is set but VLT_REGISTRY_URL is not — falling back to default npm registry"
+  elif [ -z "${VLT_REGISTRY_AUTH_TOKEN:-}" ] && [ -n "$BENCH_DEFAULT_REGISTRY_URL" ]; then
+    echo "Warning: VLT_REGISTRY_URL is set but VLT_REGISTRY_AUTH_TOKEN is not — falling back to default npm registry"
+  else
+    echo "Warning: VLT_REGISTRY_URL and VLT_REGISTRY_AUTH_TOKEN not set — falling back to default npm registry"
+  fi
+fi
+
+# Helper script that writes vlt registry + auth to .npmrc.
+# No-op when VLT_REGISTRY_AUTH_TOKEN is not set.
+# This is a standalone script (not a function) so it works in hyperfine's
+# sh -c subshells without requiring bash or export -f.
+BENCH_SETUP_VLT_REGISTRY="bash $BENCH_SCRIPTS/setup-vlt-registry.sh"
+
 BENCH_COMMAND_YARN_MODERN_CONFIG=$(cat <<EOF
 enableImmutableInstalls: false
 enableMirror: false
 nodeLinker: node-modules
 EOF
 )
+
+# When the vlt registry is active, add registry config for yarn berry/zpm.
+if [ -n "$BENCH_USE_VLT_REGISTRY" ]; then
+  BENCH_COMMAND_YARN_MODERN_CONFIG=$(cat <<EOF
+enableImmutableInstalls: false
+enableMirror: false
+nodeLinker: node-modules
+npmRegistryServer: "${BENCH_DEFAULT_REGISTRY_URL}"
+npmAuthToken: "\${VLT_REGISTRY_AUTH_TOKEN}"
+EOF
+  )
+fi
 BENCH_ZPM_VERSION="${BENCH_ZPM_VERSION:-$(curl -fsSL "https://repo.yarnpkg.com/channels/default/canary" | tr -d '[:space:]' || true)}"
 if [ -z "$BENCH_ZPM_VERSION" ]; then
   BENCH_ZPM_VERSION="6.0.0-rc.13"
 fi
-BENCH_SETUP_NPM=""
-BENCH_SETUP_YARN=""
+# Per-PM setup commands.
+# For PMs that read .npmrc (npm, yarn classic, pnpm, pacquet, bun, deno, aube),
+# setup_vlt_registry_npmrc writes the vlt registry config.
+# Berry/zpm get their config via BENCH_COMMAND_YARN_MODERN_CONFIG in .yarnrc.yml.
+# vlt uses --registry on the CLI.
+BENCH_SETUP_NPM="$BENCH_SETUP_VLT_REGISTRY"
+BENCH_SETUP_YARN="$BENCH_SETUP_VLT_REGISTRY"
 BENCH_SETUP_BERRY="echo \"$BENCH_COMMAND_YARN_MODERN_CONFIG\" > .yarnrc.yml"
 BENCH_SETUP_ZPM="echo \"$BENCH_COMMAND_YARN_MODERN_CONFIG\" > .yarnrc.yml; { echo '[zpm prepare]'; echo 'cwd:'; pwd; echo 'package.json:'; ls -la package.json || true; echo 'yarn path:'; command -v yarn || true; echo 'yarn version:'; yarn -v || true; echo 'canary version:'; echo \"$BENCH_ZPM_VERSION\"; echo 'packageManager (before):'; npm pkg get packageManager || true; echo 'set packageManager=yarn@'"$BENCH_ZPM_VERSION"':' ; npm pkg set packageManager=\"yarn@$BENCH_ZPM_VERSION\" || true; echo 'packageManager (after):'; npm pkg get packageManager || true; } >> $BENCH_OUTPUT_FOLDER/zpm-prepare.log 2>&1"
-BENCH_SETUP_PNPM="npm pkg delete packageManager >/dev/null 2>&1 || true"
+BENCH_SETUP_PNPM="$BENCH_SETUP_VLT_REGISTRY; npm pkg delete packageManager >/dev/null 2>&1 || true"
 
-BENCH_SETUP_PACQUET="npm pkg delete packageManager >/dev/null 2>&1 || true"
+BENCH_SETUP_PACQUET="$BENCH_SETUP_VLT_REGISTRY; npm pkg delete packageManager >/dev/null 2>&1 || true"
 BENCH_SETUP_VLT="node $BENCH_SCRIPTS/add-workspace-protocol.js . >> $BENCH_OUTPUT_FOLDER/vlt-prepare.log 2>&1"
-BENCH_SETUP_BUN=""
-BENCH_SETUP_DENO=""
-BENCH_SETUP_AUBE="npm pkg delete packageManager >/dev/null 2>&1 || true"
-BENCH_SETUP_NX=""
-BENCH_SETUP_TURBO=""
-BENCH_SETUP_VP=""
-BENCH_SETUP_NODE=""
+BENCH_SETUP_BUN="$BENCH_SETUP_VLT_REGISTRY"
+BENCH_SETUP_DENO="$BENCH_SETUP_VLT_REGISTRY"
+BENCH_SETUP_AUBE="$BENCH_SETUP_VLT_REGISTRY; npm pkg delete packageManager >/dev/null 2>&1 || true"
+BENCH_SETUP_NX="$BENCH_SETUP_VLT_REGISTRY"
+BENCH_SETUP_TURBO="$BENCH_SETUP_VLT_REGISTRY"
+BENCH_SETUP_VP="$BENCH_SETUP_VLT_REGISTRY"
+BENCH_SETUP_NODE="$BENCH_SETUP_VLT_REGISTRY"
 
 # Bare install commands (no log redirection) — used by strace process counting.
 # Install scripts are disabled where the PM runs them by default, so benchmarks
@@ -99,7 +151,15 @@ BENCH_INSTALL_BERRY="corepack yarn@latest install"
 BENCH_INSTALL_ZPM="yarn install --silent"
 BENCH_INSTALL_PNPM="corepack pnpm@latest install --ignore-scripts --silent"
 BENCH_INSTALL_PACQUET="pacquet install"
-BENCH_INSTALL_VLT="vlt install --view=silent"
+# vlt reads its own config (not .npmrc), so pass --registry on the CLI.
+# Auth is handled via VLT_REGISTRY + VLT_TOKEN env vars exported below.
+if [ -n "$BENCH_USE_VLT_REGISTRY" ]; then
+  export VLT_REGISTRY="$BENCH_DEFAULT_REGISTRY_URL"
+  export VLT_TOKEN="$VLT_REGISTRY_AUTH_TOKEN"
+  BENCH_INSTALL_VLT="vlt install --registry=$BENCH_DEFAULT_REGISTRY_URL --view=silent"
+else
+  BENCH_INSTALL_VLT="vlt install --view=silent"
+fi
 BENCH_INSTALL_BUN="bun install --ignore-scripts --silent"
 BENCH_INSTALL_DENO="deno install --quiet"
 BENCH_INSTALL_AUBE="aube install --silent"