diff --git a/scripts/test-declared-dependency-ranges.mjs b/scripts/test-declared-dependency-ranges.mjs
index e0f25c20..b528fb75 100644
--- a/scripts/test-declared-dependency-ranges.mjs
+++ b/scripts/test-declared-dependency-ranges.mjs
@@ -24,9 +24,16 @@ const rootRequire = createRequire(join(repoRoot, "package.json"));
 const ts = rootRequire("typescript");
 const semver = createRequire(join(npmRoot(), "package.json"))("semver");
 
+// npm ships semver, so the check needs no dependency of its own. npm's root is beside the node binary on Windows and under lib/ on Unix.
 function npmRoot() {
-  const cli = process.env.npm_execpath ?? join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
-  return dirname(dirname(cli));
+  const candidates = [
+    ...(process.env.npm_execpath ? [dirname(dirname(process.env.npm_execpath))] : []),
+    join(dirname(process.execPath), "node_modules", "npm"),
+    join(dirname(process.execPath), "..", "lib", "node_modules", "npm"),
+  ];
+  const root = candidates.find((candidate) => existsSync(join(candidate, "package.json")));
+  assert.ok(root, `npm's package root was not found in ${candidates.join(", ")}`);
+  return root;
 }
 
 function readJson(path) {