diff --git a/.github/workflows/enforce-pnpm.yml b/.github/workflows/enforce-pnpm.yml
new file mode 100644
index 0000000..171a1f0
--- /dev/null
+++ b/.github/workflows/enforce-pnpm.yml
@@ -0,0 +1,17 @@
+name: Enforce pnpm
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  reject-npm-lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Reject npm lockfiles
+        run: |
+          if git ls-files | grep -E '(^|/)package-lock\.json$'; then
+            echo "Remove package-lock.json and use pnpm."
+            exit 1
+          fi
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..024ce18
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+engine-strict=true
+min-release-age=3
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..2c73ec9
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,3 @@
+[tools]
+pnpm = "10.33.0"
+npm = "11.11.1"
diff --git a/package.json b/package.json
index 2a230de..9c0edae 100644
--- a/package.json
+++ b/package.json
@@ -1,12 +1,28 @@
 {
-    "name": "@braintrust/openapi",
-    "version": "0.0.0",
-    "private": true,
-    "exports": {
-      "./*": "./openapi/*"
-    },
-    "files": [
-      "openapi/"
-    ],
-    "license": "Apache-2.0"
+  "name": "@braintrust/openapi",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "preinstall": "node -e \"const userAgent = process.env.npm_config_user_agent || ''; if (process.env.INIT_CWD === process.cwd() && !userAgent.includes('pnpm/')) { console.error('Use pnpm in this repo.'); process.exit(1); }\""
+  },
+  "exports": {
+    "./*": "./openapi/*"
+  },
+  "files": [
+    "openapi/"
+  ],
+  "license": "Apache-2.0",
+  "packageManager": "pnpm@10.33.0",
+  "engines": {
+    "pnpm": ">=10.27.0",
+    "npm": "please-use-pnpm",
+    "yarn": "please-use-pnpm"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": ">=10.27.0",
+      "onFail": "error"
+    }
   }
+}