How to force `renv` to use a private Artifactory repository instead of P3M for specific package versions?

I am trying to force renv to download all R packages, including specific archived versions, from our private Artifactory repository. However, renv ignores my settings and defaults to Posit Package Manager (P3M) snapshots for certain packages.

For example, even with extensive configuration, when I run renv::install("jsonlite@1.8.8"), the log shows it's still downloading from P3M:

# Downloading packages -------------------------------------------------------
- Downloading jsonlite from P3M ...
# Downloading 'https://packagemanager.posit.co/cran/2024-09-20/bin/windows/contrib/4.4/jsonlite_1.8.8.zip'

My goal is for all package downloads to route exclusively through my private repo, which requires Bearer Token authentication.

My Configuration: My .Rprofile contains all recommended settings:

.Rprofile

local({
  repo_url <- "https://my-private-repo.com/artifactory/cran"
  auth_token <- Sys.getenv("PRIVATE_REPO_ACCESS_TOKEN")
  auth_header <- c(Authorization = paste("Bearer", auth_token))

  options(repos = c(PrivateRepo = repo_url))
  options(install.packages.headers = auth_header)
  options(renv.config.transform.urls = FALSE) # Disable P3M redirection
  options(renv.download.headers = function(url) {
    if (grepl(paste0("^", repo_url), url)) return(auth_header)
  })
})

source("renv/activate.R")
renv::config$repos.override("https://my-private-repo.com/artifactory/cran")

My .Renviron sets the required token:

.Renviron

PRIVATE_REPO_ACCESS_TOKEN="my_actual_token_is_here"
RENV_CONFIG_REPOS="https://my-private-repo.com/artifactory/cran"
RENV_CONFIG_BINARY_REPOS="https://my-private-repo.com/artifactory/cran"

Despite the configuration above, the problem persists. I have tried a comprehensive list of solutions, none of which have fully worked:

Setting RENV_CONFIG_REPOS_OVERRIDE in .Renviron.
Setting renv::config$repos.override() in .Rprofile.
Setting options(renv.config.transform.urls = FALSE).
A full environment reset: I deleted the project's renv directory, renv.lock, and the entire global renv cache folder (renv::paths$cache()) before reinstalling using renv::install(pkgs).

How can I definitively force renv to use only my specified private repository for all package installations? Is there a configuration setting I'm missing that has a higher priority than all the ones I've already tried? Any help would be appreciated.

Solution

I suspect you want options(renv.config.ppm.enabled = FALSE), as per https://rstudio.github.io/renv/reference/config.html#renv-config-ppm-enabled.

If the issue still persists even with this set, it would be greatly appreciated if you could share a reproducible example at https://github.com/rstudio/renv/issues.