diff --git a/CHANGELOG.md b/CHANGELOG.md
index d61c5f7..275d193 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Other Changes
 - Consolidate Dependabot updates for Vitest 4.1.11, Hono 4.13.7, qs 6.16.0, fast-uri 3.1.7, actions/deploy-pages 5.0.1, and actions/checkout 7.0.1.
+- Document local npm lockfile regeneration for contributors who cannot access the Microsoft package proxy, while retaining the proxy-generated lockfile. [#245](https://github.com/microsoft/opentelemetry-distro-javascript/pull/245)
 
 ## [1.4.0] - 2026-09-08
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c055674..d8452d7 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,6 +25,38 @@ npm run lint
 npm test
 ```
 
+### Using package-lock.json
+
+The committed `package-lock.json` is generated through Microsoft's package proxy.
+Microsoft contributors are required to use this proxy so dependencies undergo
+the required security and vulnerability policies. The lockfile can contain
+registry and tarball URLs that are inaccessible outside Microsoft.
+
+If you cannot access the proxy, generate a replacement lockfile for local use
+with an accessible npm registry. Changing `--registry` alone on the existing
+lockfile does not reliably replace recorded custom-registry tarball URLs; regenerate
+the lockfile rather than manually editing those URLs.
+
+Start in a fresh checkout without `node_modules`, or move the existing root
+`node_modules` directory outside the checkout first. This prevents reuse of
+installed packages and the hidden `node_modules/.package-lock.json`. Back up any
+local lockfile changes, then remove only the root `package-lock.json` (using your
+file manager or shell). From the repository root, generate and use a local
+lockfile, for example with the public npm registry:
+
+```bash
+npm install --package-lock-only --ignore-scripts --registry=https://registry.npmjs.org/
+npm ci --registry=https://registry.npmjs.org/
+```
+
+The first command resolves dependencies from `package.json` without installing
+them; the second installs the generated lockfile normally. Scoped registry
+settings, if configured, must also point to registries you can access.
+Resolved versions may differ from the committed lockfile because of dependency
+ranges and registry availability, including quarantine policies; this does not
+guarantee the same dependency tree. Microsoft contributors must continue using
+the required proxy rather than using this workflow to bypass its restrictions.
+
 ## Pull Requests
 
 - Describe the problem and the approach clearly.