diff --git a/composer/Template/LegacyProject/composer.json b/composer/Template/LegacyProject/composer.json
index c79a42d6ce..57539def2b 100644
--- a/composer/Template/LegacyProject/composer.json
+++ b/composer/Template/LegacyProject/composer.json
@@ -30,6 +30,14 @@
     "minimum-stability": "dev",
     "prefer-stable": true,
     "config": {
+        "allow-plugins": {
+            "composer/installers": true,
+            "drupal/core-composer-scaffold": true,
+            "drupal/core-project-message": true,
+            "drupal/core-vendor-hardening": true,
+            "phpstan/extension-installer": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true
+        },
         "sort-packages": true
     },
     "extra": {
diff --git a/composer/Template/RecommendedProject/composer.json b/composer/Template/RecommendedProject/composer.json
index 9257e238b9..b4888789c0 100644
--- a/composer/Template/RecommendedProject/composer.json
+++ b/composer/Template/RecommendedProject/composer.json
@@ -29,6 +29,13 @@
     "minimum-stability": "dev",
     "prefer-stable": true,
     "config": {
+        "allow-plugins": {
+            "composer/installers": true,
+            "drupal/core-composer-scaffold": true,
+            "drupal/core-project-message": true,
+            "phpstan/extension-installer": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true
+        },
         "sort-packages": true
     },
     "extra": {
diff --git a/core/tests/Drupal/BuildTests/Composer/Template/ComposerProjectTemplatesTest.php b/core/tests/Drupal/BuildTests/Composer/Template/ComposerProjectTemplatesTest.php
index e7e7b2801f..1d102533aa 100644
--- a/core/tests/Drupal/BuildTests/Composer/Template/ComposerProjectTemplatesTest.php
+++ b/core/tests/Drupal/BuildTests/Composer/Template/ComposerProjectTemplatesTest.php
@@ -6,6 +6,7 @@
 use Composer\Semver\VersionParser;
 use Drupal\BuildTests\Framework\BuildTestBase;
 use Drupal\Composer\Composer;
+use Drupal\Tests\Composer\Plugin\Scaffold\ExecTrait;
 
 /**
  * Demonstrate that Composer project templates are buildable as patched.
@@ -27,6 +28,8 @@
  */
 class ComposerProjectTemplatesTest extends BuildTestBase {
 
+  use ExecTrait;
+
   /**
    * The minimum stability requirement for dependencies.
    *
@@ -454,4 +457,32 @@ protected function getCoreStability() {
     return $stability;
   }
 
+  /**
+   * Tests available create-project composer templates for non-allowed plugins.
+   *
+   * @dataProvider provideTemplateCreateProject
+   */
+  public function testCreateProjectTemplatesForNonAllowedComposerPlugins(string $project, string $package_dir, string $docroot_dir): void {
+    // Make a working COMPOSER_HOME directory.
+    $composer_home = $this->getWorkspaceDirectory() . '/composer-home';
+    mkdir($composer_home);
+
+    // Copy the composer.json of the create-project template we're working on
+    // into our COMPOSER_HOME directory.
+    copy('../' . $package_dir . '/composer.json', $composer_home . '/composer.json');
+
+    // Use the copied composer.json to create a new project.
+    $output = $this->mustExec("COMPOSER_HOME=$composer_home composer create-project --no-ansi 2>&1", $composer_home);
+
+    // Check the output of the project creation for the absence of warnings
+    // about any non-allowed composer plugins.
+    // Note: There are different warnings for unallowed composer plugins
+    // depending on running in non-interactive mode or not. It seems the drupal
+    // CI environment always forces composer commands to run in the
+    // non-interactive mode. The only thing these messages have in common is the
+    // following string.
+    $allow_plugin_url = 'See https://getcomposer.org/allow-plugins';
+    $this->assertStringNotContainsString($allow_plugin_url, $output);
+  }
+
 }