diff --git a/lib/pull_request.rb b/lib/pull_request.rb
index cb16367..ecb4bde 100644
--- a/lib/pull_request.rb
+++ b/lib/pull_request.rb
@@ -38,10 +38,10 @@ def validate_single_commit
   end
 
   def validate_files_changed
+    allowed_files = ["yarn.lock", "Gemfile.lock"]
     commit = GitHubClient.instance.commit("alphagov/#{@api_response.base.repo.name}", @api_response.head.sha)
     files_changed = commit.files.map(&:filename)
-    # TODO: support other package managers too (e.g. NPM)
-    files_changed == ["Gemfile.lock"]
+    (files_changed - allowed_files).empty?
   end
 
   def validate_ci_workflow_exists
diff --git a/spec/lib/pull_request_spec.rb b/spec/lib/pull_request_spec.rb
index a1ed70e..d1c60e3 100644
--- a/spec/lib/pull_request_spec.rb
+++ b/spec/lib/pull_request_spec.rb
@@ -201,6 +201,14 @@ def create_pull_request_instance
       expect(pr.validate_files_changed).to eq(true)
     end
 
+    it "returns true if PR only changes yarn.lock" do
+      head_commit_api_response[:files][0][:filename] = "yarn.lock"
+      stub_remote_commit(head_commit_api_response)
+
+      pr = PullRequest.new(pull_request_api_response)
+      expect(pr.validate_files_changed).to eq(true)
+    end
+
     it "returns false if PR changes anything else" do
       head_commit_api_response[:files][0][:filename] = "something_else.rb"
       stub_remote_commit(head_commit_api_response)