diff --git a/.gitignore b/.gitignore
index 3aaba98..ef4aa30 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,12 @@ node_modules
 .history
 dist
 /coverage
+
+# npm is the supported package manager (CI runs `npm ci` and the
+# package-lock.json files are committed). Keep a stray lockfile from another
+# resolver out of commits — two lockfiles in the tree make `npm ci` fail in
+# confusing ways for the next person.
+bun.lock
+bun.lockb
+pnpm-lock.yaml
+yarn.lock
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 701755e..53047ef 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -6,6 +6,7 @@
 
 ## Installation
 
+- npm is the supported package manager. CI runs `npm ci`, and both `package-lock.json` files are committed — other resolvers are gitignored so a stray lockfile cannot be committed by accident.
 - Running `npm install` in the component's root directory will install everything you need for development.
 - Running `npm install` in the `demo` directory will install everything you need to run the demo app locally.