diff --git a/.npmignore b/.npmignore
deleted file mode 100644
index 3a31a9b..0000000
--- a/.npmignore
+++ /dev/null
@@ -1,7 +0,0 @@
-# ignore everything
-*
-*/**
-
-# except lib and package.json
-!lib/**/*
-!package.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad1f5be..0125fc7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased](https://github.com/promaster-sdk/api-server/compare/v4.0.0...master)
 
+- Fix: the npm package published with `pnpm publish` (4.0.1, 4.0.2) only contained `lib/index.js`. The package now uses `"files": ["lib"]` instead of `.npmignore`.
+
 ## [4.0.0](https://github.com/promaster-sdk/api-server/compare/v3.9.1...v4.0.0)
 
 - BREAKING: The package is now ESM (`"type": "module"`). CommonJS consumers can still `require()` it on Node versions with `require(esm)` support.
diff --git a/package.json b/package.json
index 5eedbce..6c32e46 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,9 @@
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
   "publishConfig": {
     "access": "public"
   },