diff --git a/.gitignore b/.gitignore
index 9c7dbb960..b5d801572 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ node_modules
 coverage
 bench/.results
 types/generated.d.ts
+/package-lock.json.md5
diff --git a/.travis.yml b/.travis.yml
index 08266acf3..989ab7aef 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,5 +1,6 @@
 language: node_js
 node_js:
+  - 9
   - 8
   - 6
   - 4
@@ -8,6 +9,8 @@ env:
   - FRESH_DEPS=true
 matrix:
   exclude:
+    - node_js: 9
+      env: FRESH_DEPS=true
     - node_js: 6
       env: FRESH_DEPS=true
     - node_js: 4
@@ -16,8 +19,17 @@ cache:
   directories:
     - $HOME/.npm
 before_install:
-  - npm install --global npm@5.4.2
+  - npm install --global npm@5.6.0
   - npm --version
-install:
-  - if [[ ${FRESH_DEPS} == "true" ]]; then npm install --no-shrinkwrap --prefer-online; else npm install --prefer-offline; fi
-after_success: ./node_modules/.bin/codecov --file=./coverage/lcov.info
+  - md5sum package-lock.json > package-lock.json.md5
+install: |
+  if [[ ${FRESH_DEPS} == "true" ]]; then
+    npm install --no-shrinkwrap --prefer-online;
+  else
+    npm install --prefer-offline;
+    if ! md5sum --quiet -c package-lock.json.md5; then
+      echo "package-lock.json was modified unexpectedly. Please rebuild it using npm@$(npm -v) and commit the changes.";
+      exit 1;
+    fi
+  fi
+after_success: npx codecov --file=./coverage/lcov.info
diff --git a/appveyor.yml b/appveyor.yml
index 429067b33..45b6c9881 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,19 +11,22 @@ configuration:
   - LockedDeps
 environment:
   matrix:
+    - nodejs_version: 9
     - nodejs_version: 8
     - nodejs_version: 6
     - nodejs_version: 4
 matrix:
   fast_finish: true
   exclude:
+    - configuration: FreshDeps
+      nodejs_version: 9
     - configuration: FreshDeps
       nodejs_version: 6
     - configuration: FreshDeps
       nodejs_version: 4
 install:
   - ps: Install-Product node $env:nodejs_version
-  - npm install --global npm@5.4.2
+  - npm install --global npm@5.6.0
   - npm --version
   - git config core.symlinks true
   - git reset --hard
diff --git a/contributing.md b/contributing.md
index 4b4d5c3d3..a7e651c3d 100644
--- a/contributing.md
+++ b/contributing.md
@@ -40,6 +40,8 @@ You may find an issue is assigned, or has the [`assigned` label](https://github.
 
 We'd like to fix [`priority` issues](https://github.com/avajs/ava/labels/priority) first. We'd love to see progress on [`low-priority` issues](https://github.com/avajs/ava/labels/low%20priority) too. [`future` issues](https://github.com/avajs/ava/labels/future) are those that we'd like to get to, but not anytime soon. Please check before working on these since we may not yet want to take on the burden of supporting those features.
 
+If you're updating dependencies, please make sure you use npm@5.6.0 and commit the updated `package-lock.json` file.
+
 ### Hang out in our chat
 
 We have a [chat](https://gitter.im/avajs/ava). Jump in there and lurk, talk to us, and help others.