diff --git a/.changeset/gold-flowers-clean.md b/.changeset/gold-flowers-clean.md
new file mode 100644
index 0000000..9f7d082
--- /dev/null
+++ b/.changeset/gold-flowers-clean.md
@@ -0,0 +1,5 @@
+---
+"@vercel/sandbox": patch
+---
+
+Build and publish both ESM and CJS outputs for the SDK package.
diff --git a/packages/vercel-sandbox/package.json b/packages/vercel-sandbox/package.json
index 3e3af4b..8c6d06c 100644
--- a/packages/vercel-sandbox/package.json
+++ b/packages/vercel-sandbox/package.json
@@ -1,9 +1,26 @@
 {
   "name": "@vercel/sandbox",
+  "type": "module",
   "version": "1.8.0",
   "description": "Software Development Kit for Vercel Sandbox",
-  "main": "dist/index.js",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.cjs"
+    },
+    "./dist/*.js": {
+      "import": "./dist/*.js",
+      "require": "./dist/*.cjs",
+      "default": "./dist/*.cjs"
+    },
+    "./dist/*": "./dist/*",
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist",
     "README.md",
@@ -11,7 +28,7 @@
   ],
   "scripts": {
     "clean": "rm -rf node_modules dist",
-    "build": "tsc",
+    "build": "tsdown",
     "test": "vitest run",
     "typedoc": "typedoc",
     "typecheck": "tsc --noEmit",
@@ -49,6 +66,7 @@
     "dotenv": "16.5.0",
     "factoree": "^0.1.2",
     "typedoc": "0.28.5",
+    "tsdown": "catalog:",
     "typescript": "5.8.3",
     "vitest": "catalog:"
   }
diff --git a/packages/vercel-sandbox/src/api-client/api-client.test.ts b/packages/vercel-sandbox/src/api-client/api-client.test.ts
index 8b66d70..f13b019 100644
--- a/packages/vercel-sandbox/src/api-client/api-client.test.ts
+++ b/packages/vercel-sandbox/src/api-client/api-client.test.ts
@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { APIClient } from "./api-client";
-import { APIError, StreamError } from "./api-error";
-import { createNdjsonStream } from "../../test-utils/mock-response";
+import { APIClient } from "./api-client.js";
+import { APIError, StreamError } from "./api-error.js";
+import { createNdjsonStream } from "../../test-utils/mock-response.js";
 
 describe("APIClient", () => {
   describe("getLogs", () => {
diff --git a/packages/vercel-sandbox/src/api-client/api-client.ts b/packages/vercel-sandbox/src/api-client/api-client.ts
index aeb0230..81ed1e5 100644
--- a/packages/vercel-sandbox/src/api-client/api-client.ts
+++ b/packages/vercel-sandbox/src/api-client/api-client.ts
@@ -3,7 +3,7 @@ import {
   parseOrThrow,
   type Parsed,
   type RequestParams,
-} from "./base-client";
+} from "./base-client.js";
 import {
 CommandFinishedData,
   SandboxAndRoutesResponse,
@@ -21,21 +21,21 @@ CommandFinishedData,
   SnapshotResponse,
   CreateSnapshotResponse,
   type CommandData,
-} from "./validators";
-import { APIError, StreamError } from "./api-error";
-import { FileWriter } from "./file-writer";
-import { VERSION } from "../version";
-import { consumeReadable } from "../utils/consume-readable";
+} from "./validators.js";
+import { APIError, StreamError } from "./api-error.js";
+import { FileWriter } from "./file-writer.js";
+import { VERSION } from "../version.js";
+import { consumeReadable } from "../utils/consume-readable.js";
 import { z } from "zod";
 import jsonlines from "jsonlines";
 import os from "os";
 import { Readable } from "stream";
-import { normalizePath } from "../utils/normalizePath";
+import { normalizePath } from "../utils/normalizePath.js";
 import { getVercelOidcToken } from "@vercel/oidc";
-import { NetworkPolicy } from "../network-policy";
-import { toAPINetworkPolicy, fromAPINetworkPolicy } from "../utils/network-policy";
-import { getPrivateParams, WithPrivate } from "../utils/types";
-import { RUNTIMES } from "../constants";
+import { NetworkPolicy } from "../network-policy.js";
+import { toAPINetworkPolicy, fromAPINetworkPolicy } from "../utils/network-policy.js";
+import { getPrivateParams, WithPrivate } from "../utils/types.js";
+import { RUNTIMES } from "../constants.js";
 import { setTimeout } from "node:timers/promises";
 
 interface Claims {
diff --git a/packages/vercel-sandbox/src/api-client/base-client.ts b/packages/vercel-sandbox/src/api-client/base-client.ts
index 2d24d7f..172da71 100644
--- a/packages/vercel-sandbox/src/api-client/base-client.ts
+++ b/packages/vercel-sandbox/src/api-client/base-client.ts
@@ -1,8 +1,8 @@
 import type { Options as RetryOptions } from "async-retry";
-import { APIError } from "./api-error";
+import { APIError } from "./api-error.js";
 import { ZodType } from "zod";
-import { array } from "../utils/array";
-import { withRetry, type RequestOptions } from "./with-retry";
+import { array } from "../utils/array.js";
+import { withRetry, type RequestOptions } from "./with-retry.js";
 import { Agent } from "undici";
 
 export interface RequestParams extends RequestInit {
diff --git a/packages/vercel-sandbox/src/api-client/index.ts b/packages/vercel-sandbox/src/api-client/index.ts
index 3535b47..3ecad4d 100644
--- a/packages/vercel-sandbox/src/api-client/index.ts
+++ b/packages/vercel-sandbox/src/api-client/index.ts
@@ -1,2 +1,2 @@
-export { APIClient } from "./api-client";
-export * from "./validators";
+export { APIClient } from "./api-client.js";
+export * from "./validators.js";
diff --git a/packages/vercel-sandbox/src/api-client/with-retry.ts b/packages/vercel-sandbox/src/api-client/with-retry.ts
index 39ee466..86518c9 100644
--- a/packages/vercel-sandbox/src/api-client/with-retry.ts
+++ b/packages/vercel-sandbox/src/api-client/with-retry.ts
@@ -1,5 +1,5 @@
 import type { Options as RetryOptions } from "async-retry";
-import { APIError } from "./api-error";
+import { APIError } from "./api-error.js";
 import { setTimeout } from "node:timers/promises";
 import retry from "async-retry";
 
diff --git a/packages/vercel-sandbox/src/auth/api.ts b/packages/vercel-sandbox/src/auth/api.ts
index b4da1e1..535fe96 100644
--- a/packages/vercel-sandbox/src/auth/api.ts
+++ b/packages/vercel-sandbox/src/auth/api.ts
@@ -1,4 +1,4 @@
-import { NotOk } from "./error";
+import { NotOk } from "./error.js";
 
 export async function fetchApi(opts: {
   token: string;
diff --git a/packages/vercel-sandbox/src/auth/file.ts b/packages/vercel-sandbox/src/auth/file.ts
index 0c39b4c..22f0fdd 100644
--- a/packages/vercel-sandbox/src/auth/file.ts
+++ b/packages/vercel-sandbox/src/auth/file.ts
@@ -3,7 +3,7 @@ import fs from "node:fs";
 import { homedir } from "node:os";
 import XDGAppPaths from "xdg-app-paths";
 import { z } from "zod";
-import { json } from "./zod";
+import { json } from "./zod.js";
 
 const ZodDate = z.number().transform((seconds) => new Date(seconds * 1000));
 
diff --git a/packages/vercel-sandbox/src/auth/index.ts b/packages/vercel-sandbox/src/auth/index.ts
index aae7d4b..f2c6d3c 100644
--- a/packages/vercel-sandbox/src/auth/index.ts
+++ b/packages/vercel-sandbox/src/auth/index.ts
@@ -1,9 +1,9 @@
 // This file can also be imported as `@vercel/sandbox/dist/auth`, which is completely fine.
 // The only valid importer of this would be the CLI as we share the same codebase.
 
-export * from "./file";
-export type * from "./file";
-export * from "./oauth";
-export type * from "./oauth";
-export { pollForToken } from "./poll-for-token";
-export { inferScope, selectTeam } from "./project";
+export * from "./file.js";
+export type * from "./file.js";
+export * from "./oauth.js";
+export type * from "./oauth.js";
+export { pollForToken } from "./poll-for-token.js";
+export { inferScope, selectTeam } from "./project.js";
diff --git a/packages/vercel-sandbox/src/auth/infer-scope.test.ts b/packages/vercel-sandbox/src/auth/infer-scope.test.ts
index 6d4a825..c8e0810 100644
--- a/packages/vercel-sandbox/src/auth/infer-scope.test.ts
+++ b/packages/vercel-sandbox/src/auth/infer-scope.test.ts
@@ -1,4 +1,4 @@
-import { inferScope, selectTeam } from "./project";
+import { inferScope, selectTeam } from "./project.js";
 import {
   beforeEach,
   describe,
@@ -8,8 +8,8 @@ import {
   expect,
   onTestFinished,
 } from "vitest";
-import { fetchApi } from "./api";
-import { NotOk } from "./error";
+import { fetchApi } from "./api.js";
+import { NotOk } from "./error.js";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
diff --git a/packages/vercel-sandbox/src/auth/linked-project.test.ts b/packages/vercel-sandbox/src/auth/linked-project.test.ts
index ae022d3..e0abe06 100644
--- a/packages/vercel-sandbox/src/auth/linked-project.test.ts
+++ b/packages/vercel-sandbox/src/auth/linked-project.test.ts
@@ -1,4 +1,4 @@
-import { readLinkedProject } from "./linked-project";
+import { readLinkedProject } from "./linked-project.js";
 import { describe, test, expect } from "vitest";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
diff --git a/packages/vercel-sandbox/src/auth/linked-project.ts b/packages/vercel-sandbox/src/auth/linked-project.ts
index f2f458c..e4c4651 100644
--- a/packages/vercel-sandbox/src/auth/linked-project.ts
+++ b/packages/vercel-sandbox/src/auth/linked-project.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { json } from "./zod";
+import { json } from "./zod.js";
 
 const LinkedProjectSchema = json.pipe(
   z.object({
diff --git a/packages/vercel-sandbox/src/auth/oauth.ts b/packages/vercel-sandbox/src/auth/oauth.ts
index f29a5b4..143ef7a 100644
--- a/packages/vercel-sandbox/src/auth/oauth.ts
+++ b/packages/vercel-sandbox/src/auth/oauth.ts
@@ -1,6 +1,6 @@
 import os from "os";
 import { z } from "zod";
-import { VERSION } from "../version";
+import { VERSION } from "../version.js";
 
 const USER_AGENT = `${os.hostname()} @ vercel/sandbox/${VERSION} node-${
   process.version
diff --git a/packages/vercel-sandbox/src/auth/poll-for-token.ts b/packages/vercel-sandbox/src/auth/poll-for-token.ts
index af9255a..d41d586 100644
--- a/packages/vercel-sandbox/src/auth/poll-for-token.ts
+++ b/packages/vercel-sandbox/src/auth/poll-for-token.ts
@@ -1,6 +1,6 @@
 import { setTimeout } from "node:timers/promises";
-import { updateAuthConfig } from "./file";
-import { DeviceAuthorizationRequest, isOAuthError, OAuth } from "./oauth";
+import { updateAuthConfig } from "./file.js";
+import { DeviceAuthorizationRequest, isOAuthError, OAuth } from "./oauth.js";
 
 export type PollTokenItem =
   | { _tag: "Timeout"; newInterval: number }
diff --git a/packages/vercel-sandbox/src/auth/project.ts b/packages/vercel-sandbox/src/auth/project.ts
index 1322585..a97cec5 100644
--- a/packages/vercel-sandbox/src/auth/project.ts
+++ b/packages/vercel-sandbox/src/auth/project.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { fetchApi } from "./api";
-import { NotOk } from "./error";
-import { readLinkedProject } from "./linked-project";
+import { fetchApi } from "./api.js";
+import { NotOk } from "./error.js";
+import { readLinkedProject } from "./linked-project.js";
 
 const TeamsSchema = z.object({
   teams: z
diff --git a/packages/vercel-sandbox/src/command.test.ts b/packages/vercel-sandbox/src/command.test.ts
index 3111be6..f2e6d21 100644
--- a/packages/vercel-sandbox/src/command.test.ts
+++ b/packages/vercel-sandbox/src/command.test.ts
@@ -1,5 +1,5 @@
 import { expect, it, vi, beforeEach, afterEach, describe } from "vitest";
-import { Sandbox } from "./sandbox";
+import { Sandbox } from "./sandbox.js";
 
 describe.skipIf(process.env.RUN_INTEGRATION_TESTS !== "1")("Command", () => {
   let sandbox: Sandbox;
diff --git a/packages/vercel-sandbox/src/command.ts b/packages/vercel-sandbox/src/command.ts
index 0729d13..035e33a 100644
--- a/packages/vercel-sandbox/src/command.ts
+++ b/packages/vercel-sandbox/src/command.ts
@@ -1,5 +1,5 @@
-import { APIClient, type CommandData } from "./api-client";
-import { Signal, resolveSignal } from "./utils/resolveSignal";
+import { APIClient, type CommandData } from "./api-client/index.js";
+import { Signal, resolveSignal } from "./utils/resolveSignal.js";
 
 /**
  * A command executed in a Sandbox.
diff --git a/packages/vercel-sandbox/src/index.ts b/packages/vercel-sandbox/src/index.ts
index 5540c76..c5af466 100644
--- a/packages/vercel-sandbox/src/index.ts
+++ b/packages/vercel-sandbox/src/index.ts
@@ -3,8 +3,8 @@ export {
   type NetworkPolicy,
   type NetworkPolicyRule,
   type NetworkTransformer,
-} from "./sandbox";
-export { Snapshot } from "./snapshot";
-export { Command, CommandFinished } from "./command";
-export { StreamError } from "./api-client/api-error";
-export { APIError } from "./api-client/api-error";
+} from "./sandbox.js";
+export { Snapshot } from "./snapshot.js";
+export { Command, CommandFinished } from "./command.js";
+export { StreamError } from "./api-client/api-error.js";
+export { APIError } from "./api-client/api-error.js";
diff --git a/packages/vercel-sandbox/src/package-exports.test.ts b/packages/vercel-sandbox/src/package-exports.test.ts
new file mode 100644
index 0000000..579f23b
--- /dev/null
+++ b/packages/vercel-sandbox/src/package-exports.test.ts
@@ -0,0 +1,70 @@
+import { expect, it } from "vitest";
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+it("defines import/require export targets", () => {
+  const packageJsonPath = resolve(__dirname, "..", "package.json");
+  const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+
+  expect(packageJson.exports?.["."]?.import).toBe("./dist/index.js");
+  expect(packageJson.exports?.["."]?.require).toBe("./dist/index.cjs");
+  expect(packageJson.exports?.["."]?.types).toBe("./dist/index.d.ts");
+  expect(packageJson.exports?.["./dist/*.js"]?.import).toBe("./dist/*.js");
+  expect(packageJson.exports?.["./dist/*.js"]?.require).toBe("./dist/*.cjs");
+  expect(packageJson.exports?.["./dist/*"]).toBe("./dist/*");
+});
+
+it("resolves import and require to different entrypoints", () => {
+  const packageRoot = resolve(__dirname, "..");
+
+  const cjsResolution = execFileSync(
+    process.execPath,
+    ["-e", "console.log(require.resolve('@vercel/sandbox'))"],
+    { cwd: packageRoot, encoding: "utf8" },
+  ).trim();
+
+  const esmResolutionUrl = execFileSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      "console.log(await import.meta.resolve('@vercel/sandbox'))",
+    ],
+    { cwd: packageRoot, encoding: "utf8" },
+  ).trim();
+
+  const esmResolution = fileURLToPath(esmResolutionUrl);
+
+  expect(cjsResolution).toBe(resolve(packageRoot, "dist/index.cjs"));
+  expect(esmResolution).toBe(resolve(packageRoot, "dist/index.js"));
+});
+
+it("resolves deep dist imports with format-appropriate files", () => {
+  const packageRoot = resolve(__dirname, "..");
+
+  const cjsResolution = execFileSync(
+    process.execPath,
+    [
+      "-e",
+      "console.log(require.resolve('@vercel/sandbox/dist/auth/index.js'))",
+    ],
+    { cwd: packageRoot, encoding: "utf8" },
+  ).trim();
+
+  const esmResolutionUrl = execFileSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      "console.log(await import.meta.resolve('@vercel/sandbox/dist/auth/index.js'))",
+    ],
+    { cwd: packageRoot, encoding: "utf8" },
+  ).trim();
+
+  const esmResolution = fileURLToPath(esmResolutionUrl);
+
+  expect(cjsResolution).toBe(resolve(packageRoot, "dist/auth/index.cjs"));
+  expect(esmResolution).toBe(resolve(packageRoot, "dist/auth/index.js"));
+});
diff --git a/packages/vercel-sandbox/src/sandbox.test.ts b/packages/vercel-sandbox/src/sandbox.test.ts
index 6c796c9..8710931 100644
--- a/packages/vercel-sandbox/src/sandbox.test.ts
+++ b/packages/vercel-sandbox/src/sandbox.test.ts
@@ -1,7 +1,7 @@
 import { it, beforeEach, afterEach, expect, describe } from "vitest";
-import { consumeReadable } from "./utils/consume-readable";
-import { Sandbox } from "./sandbox";
-import { APIError } from "./api-client/api-error";
+import { consumeReadable } from "./utils/consume-readable.js";
+import { Sandbox } from "./sandbox.js";
+import { APIError } from "./api-client/api-error.js";
 import { mkdtemp, readFile, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join, resolve } from "path";
diff --git a/packages/vercel-sandbox/src/sandbox.ts b/packages/vercel-sandbox/src/sandbox.ts
index c93c96a..229a921 100644
--- a/packages/vercel-sandbox/src/sandbox.ts
+++ b/packages/vercel-sandbox/src/sandbox.ts
@@ -1,23 +1,26 @@
-import type { SandboxMetaData, SandboxRouteData } from "./api-client";
+import type { SandboxMetaData, SandboxRouteData } from "./api-client/index.js";
 import { type Writable } from "stream";
 import { pipeline } from "stream/promises";
 import { createWriteStream } from "fs";
 import { mkdir } from "fs/promises";
 import { dirname, resolve } from "path";
-import { APIClient } from "./api-client";
-import { Command, CommandFinished } from "./command";
-import { type Credentials, getCredentials } from "./utils/get-credentials";
-import { getPrivateParams, WithPrivate } from "./utils/types";
-import { WithFetchOptions } from "./api-client/api-client";
-import { RUNTIMES } from "./constants";
-import { Snapshot } from "./snapshot";
-import { consumeReadable } from "./utils/consume-readable";
+import { APIClient } from "./api-client/index.js";
+import { Command, CommandFinished } from "./command.js";
+import { type Credentials, getCredentials } from "./utils/get-credentials.js";
+import { getPrivateParams, WithPrivate } from "./utils/types.js";
+import { WithFetchOptions } from "./api-client/api-client.js";
+import { RUNTIMES } from "./constants.js";
+import { Snapshot } from "./snapshot.js";
+import { consumeReadable } from "./utils/consume-readable.js";
 import {
   type NetworkPolicy,
   type NetworkPolicyRule,
   type NetworkTransformer,
-} from "./network-policy";
-import { convertSandbox, type ConvertedSandbox } from "./utils/convert-sandbox";
+} from "./network-policy.js";
+import {
+  convertSandbox,
+  type ConvertedSandbox,
+} from "./utils/convert-sandbox.js";
 
 export type { NetworkPolicy, NetworkPolicyRule, NetworkTransformer };
 
@@ -226,7 +229,9 @@ export class Sandbox {
   /**
    * The amount of network data used by the sandbox. Only reported once the VM is stopped.
    */
-  public get networkTransfer(): {ingress: number, egress: number} | undefined {
+  public get networkTransfer():
+    | { ingress: number; egress: number }
+    | undefined {
     return this.sandbox.networkTransfer;
   }
 
@@ -444,7 +449,7 @@ export class Sandbox {
           }
         })();
       }
-    }
+    };
 
     if (wait) {
       const commandStream = await this.client.runCommand({
@@ -464,7 +469,7 @@ export class Sandbox {
         cmd: commandStream.command,
       });
 
-      getLogs(command); 
+      getLogs(command);
 
       const finished = await commandStream.finished;
       return new CommandFinished({
@@ -601,7 +606,7 @@ export class Sandbox {
       });
       return dstPath;
     } finally {
-      stream.destroy()
+      stream.destroy();
     }
   }
 
@@ -652,7 +657,10 @@ export class Sandbox {
    * @param opts.blocking - If true, poll until the sandbox has fully stopped and return the final state.
    * @returns The sandbox metadata at the time the stop was acknowledged, or after fully stopped if `blocking` is true.
    */
-  async stop(opts?: { signal?: AbortSignal; blocking?: boolean }): Promise<ConvertedSandbox> {
+  async stop(opts?: {
+    signal?: AbortSignal;
+    blocking?: boolean;
+  }): Promise<ConvertedSandbox> {
     const response = await this.client.stopSandbox({
       sandboxId: this.sandbox.id,
       signal: opts?.signal,
diff --git a/packages/vercel-sandbox/src/snapshot.ts b/packages/vercel-sandbox/src/snapshot.ts
index 3ae1f66..d3561c8 100644
--- a/packages/vercel-sandbox/src/snapshot.ts
+++ b/packages/vercel-sandbox/src/snapshot.ts
@@ -1,7 +1,7 @@
-import type { SnapshotMetadata } from "./api-client";
-import { APIClient } from "./api-client";
-import { WithFetchOptions } from "./api-client/api-client";
-import { Credentials, getCredentials } from "./utils/get-credentials";
+import type { SnapshotMetadata } from "./api-client/index.js";
+import { APIClient } from "./api-client/index.js";
+import { WithFetchOptions } from "./api-client/api-client.js";
+import { Credentials, getCredentials } from "./utils/get-credentials.js";
 
 /** @inline */
 interface GetSnapshotParams {
diff --git a/packages/vercel-sandbox/src/utils/convert-sandbox.ts b/packages/vercel-sandbox/src/utils/convert-sandbox.ts
index 0996334..c2ce0fa 100644
--- a/packages/vercel-sandbox/src/utils/convert-sandbox.ts
+++ b/packages/vercel-sandbox/src/utils/convert-sandbox.ts
@@ -1,6 +1,6 @@
-import type { SandboxMetaData } from "../api-client";
-import type { NetworkPolicy } from "../network-policy";
-import { fromAPINetworkPolicy } from "./network-policy";
+import type { SandboxMetaData } from "../api-client/index.js";
+import type { NetworkPolicy } from "../network-policy.js";
+import { fromAPINetworkPolicy } from "./network-policy.js";
 
 export type ConvertedSandbox = Omit<SandboxMetaData, "networkPolicy"> & {
   networkPolicy?: NetworkPolicy;
diff --git a/packages/vercel-sandbox/src/utils/dev-credentials.test.ts b/packages/vercel-sandbox/src/utils/dev-credentials.test.ts
index 25a0e7e..8c5310f 100644
--- a/packages/vercel-sandbox/src/utils/dev-credentials.test.ts
+++ b/packages/vercel-sandbox/src/utils/dev-credentials.test.ts
@@ -1,8 +1,8 @@
-import { signInAndGetToken, generateCredentials } from "./dev-credentials";
+import { signInAndGetToken, generateCredentials } from "./dev-credentials.js";
 import { describe, expect, test, vi, beforeEach, type Mock } from "vitest";
 import { factory } from "factoree";
 import { setTimeout } from "node:timers/promises";
-import { DeviceAuthorizationRequest, OAuth } from "../auth";
+import { DeviceAuthorizationRequest, OAuth } from "../auth.js";
 
 vi.mock("picocolors");
 
@@ -14,7 +14,7 @@ vi.mock("../auth/index", () => ({
   pollForToken: vi.fn(),
 }));
 
-import * as auth from "../auth/index";
+import * as auth from "../auth/index.js";
 
 describe("signInAndGetToken", () => {
   test("times out after provided timeout", async () => {
diff --git a/packages/vercel-sandbox/src/utils/dev-credentials.ts b/packages/vercel-sandbox/src/utils/dev-credentials.ts
index c3c778b..f3b2a61 100644
--- a/packages/vercel-sandbox/src/utils/dev-credentials.ts
+++ b/packages/vercel-sandbox/src/utils/dev-credentials.ts
@@ -1,10 +1,10 @@
 import pico from "picocolors";
-import type { Credentials } from "./get-credentials";
+import type { Credentials } from "./get-credentials.js";
 import ms from "ms";
-import * as Log from "./log";
+import * as Log from "./log.js";
 
 async function importAuth() {
-  const auth = await import("../auth/index");
+  const auth = await import("../auth/index.js");
   return auth;
 }
 
diff --git a/packages/vercel-sandbox/src/utils/get-credentials.test.ts b/packages/vercel-sandbox/src/utils/get-credentials.test.ts
index 13dcf28..86f6ab4 100644
--- a/packages/vercel-sandbox/src/utils/get-credentials.test.ts
+++ b/packages/vercel-sandbox/src/utils/get-credentials.test.ts
@@ -3,7 +3,7 @@ import {
   getCredentials,
   LocalOidcContextError,
   VercelOidcContextError,
-} from "./get-credentials";
+} from "./get-credentials.js";
 
 beforeEach(() => {
   delete process.env.VERCEL_OIDC_TOKEN;
diff --git a/packages/vercel-sandbox/src/utils/get-credentials.ts b/packages/vercel-sandbox/src/utils/get-credentials.ts
index d5bd9f4..66bddf0 100644
--- a/packages/vercel-sandbox/src/utils/get-credentials.ts
+++ b/packages/vercel-sandbox/src/utils/get-credentials.ts
@@ -1,10 +1,10 @@
 import { getVercelOidcToken } from "@vercel/oidc";
-import { decodeBase64Url } from "./decode-base64-url";
+import { decodeBase64Url } from "./decode-base64-url.js";
 import { z } from "zod";
 import {
   cachedGenerateCredentials,
   shouldPromptForCredentials,
-} from "./dev-credentials";
+} from "./dev-credentials.js";
 
 export interface Credentials {
   /**
diff --git a/packages/vercel-sandbox/src/utils/network-policy.test.ts b/packages/vercel-sandbox/src/utils/network-policy.test.ts
index 7ab64bd..1162937 100644
--- a/packages/vercel-sandbox/src/utils/network-policy.test.ts
+++ b/packages/vercel-sandbox/src/utils/network-policy.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { fromAPINetworkPolicy, toAPINetworkPolicy } from "./network-policy";
+import { fromAPINetworkPolicy, toAPINetworkPolicy } from "./network-policy.js";
 
 describe("toAPINetworkPolicy", () => {
   it("converts allow-all", () => {
diff --git a/packages/vercel-sandbox/src/utils/network-policy.ts b/packages/vercel-sandbox/src/utils/network-policy.ts
index 8cbfa03..d955188 100644
--- a/packages/vercel-sandbox/src/utils/network-policy.ts
+++ b/packages/vercel-sandbox/src/utils/network-policy.ts
@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { NetworkPolicy, NetworkPolicyRule } from "../network-policy";
-import { NetworkPolicyValidator, InjectionRuleValidator } from "../api-client/validators";
+import { NetworkPolicy, NetworkPolicyRule } from "../network-policy.js";
+import { NetworkPolicyValidator, InjectionRuleValidator } from "../api-client/validators.js";
 
 type APINetworkPolicy = z.infer<typeof NetworkPolicyValidator>;
 
diff --git a/packages/vercel-sandbox/src/utils/normalizePath.test.ts b/packages/vercel-sandbox/src/utils/normalizePath.test.ts
index 956cd46..9c2f443 100644
--- a/packages/vercel-sandbox/src/utils/normalizePath.test.ts
+++ b/packages/vercel-sandbox/src/utils/normalizePath.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { normalizePath } from "./normalizePath";
+import { normalizePath } from "./normalizePath.js";
 
 describe("normalizePath", () => {
   it("handles base cases", () => {
diff --git a/packages/vercel-sandbox/tsconfig.json b/packages/vercel-sandbox/tsconfig.json
index 719961c..730d907 100644
--- a/packages/vercel-sandbox/tsconfig.json
+++ b/packages/vercel-sandbox/tsconfig.json
@@ -1,6 +1,5 @@
 {
   "compilerOptions": {
-    "outDir": "./dist",
     "esModuleInterop": true,
     "skipLibCheck": true,
     "lib": ["ESNext"],
@@ -8,7 +7,8 @@
     "target": "ES2020",
     "declaration": true,
     "sourceMap": true,
-    "module": "commonjs",
+    "module": "ES2020",
+    "moduleResolution": "node",
     "resolveJsonModule": true
   },
   "include": ["src/**/*.ts"],
diff --git a/packages/vercel-sandbox/tsdown.config.ts b/packages/vercel-sandbox/tsdown.config.ts
new file mode 100644
index 0000000..06d3532
--- /dev/null
+++ b/packages/vercel-sandbox/tsdown.config.ts
@@ -0,0 +1,14 @@
+import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: ["src/index.ts", "src/auth/index.ts"],
+  outDir: "dist",
+  format: ["esm", "cjs"],
+  outExtensions: ({ format }) => ({
+    js: format === "cjs" ? ".cjs" : ".js",
+  }),
+  unbundle: true,
+  sourcemap: true,
+  dts: true,
+  target: "es2020",
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b28a858..72494ac 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -383,6 +383,9 @@ importers:
       factoree:
         specifier: ^0.1.2
         version: 0.1.2
+      tsdown:
+        specifier: 'catalog:'
+        version: 0.16.6(typescript@5.8.3)
       typedoc:
         specifier: 0.28.5
         version: 0.28.5(typescript@5.8.3)