diff --git a/.devcontainer/README.md b/.devcontainer/README.md
index 1a60315f3..ed27c9de9 100644
--- a/.devcontainer/README.md
+++ b/.devcontainer/README.md
@@ -33,6 +33,26 @@ once, and the volume keeps it.
 3. Reinstall any apt packages you use (see the example below) — their auth and
    config are already on the volume.
 
+## Feature versions are pinned (lockfile)
+
+[devcontainer-lock.json](devcontainer-lock.json) pins the exact versions of the
+Dev Container Features (`node`, `git`) referenced by
+[devcontainer.json](devcontainer.json), the same way `package-lock.json` pins
+npm dependencies. Without it, `node:1` / `git:1` resolve to the newest upstream
+release on every image build, and any new Feature release invalidates the
+Docker layer that installs them — turning the next container create into a
+multi-minute rebuild (several `apt` rounds plus the node toolchain install).
+With the lockfile committed, image builds keep hitting the cached layer until
+the pins are deliberately updated (run from the repository root, so
+`--workspace-folder .` resolves to the folder containing `.devcontainer/`):
+
+```bash
+npx @devcontainers/cli upgrade --workspace-folder .
+```
+
+Commit the updated lockfile afterwards. (Deleting the lockfile and rebuilding
+has the same effect, minus the reproducibility.)
+
 ## Example: one developer's loadout (Claude Code + GitHub CLI)
 
 An example of setting up personal tooling so that it persists. Substitute your
diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json
new file mode 100644
index 000000000..9fc1270a7
--- /dev/null
+++ b/.devcontainer/devcontainer-lock.json
@@ -0,0 +1,14 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "1.3.8",
+      "resolved": "ghcr.io/devcontainers/features/git@sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2",
+      "integrity": "sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2"
+    },
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "1.7.1",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:8c0de46939b61958041700ee89e3493f3b2e4131a06dc46b4d9423427d06e5f6",
+      "integrity": "sha256:8c0de46939b61958041700ee89e3493f3b2e4131a06dc46b4d9423427d06e5f6"
+    }
+  }
+}
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index b17ef2ea5..fe0730285 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -15,7 +15,7 @@
 	// Use 'forwardPorts' to make a list of ports inside the container available locally.
 	// "forwardPorts": [],
 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "npm install && npm run build:lib && cd packages/openbridge-webcomponents && npx playwright install --with-deps chromium",
+	"postCreateCommand": "npm install && cd packages/openbridge-webcomponents && npm run build && npx playwright install --with-deps chromium",
 	// Persist the container user's home directory across rebuilds (named Docker
 	// volume). Tool-agnostic developer convenience: anything installed into
 	// $HOME survives "Rebuild Container" — per-developer AI/CLI tooling and its
diff --git a/README.md b/README.md
index dac013303..c231f4666 100644
--- a/README.md
+++ b/README.md
@@ -103,7 +103,7 @@ To get started with developing the components:
 1. Clone the repository.
 2. Install Node.js (v20+).
 3. Run `npm install` in the root folder.
-4. Run `npm run build:lib` to build all libraries.
+4. Run `npm run build -w packages/openbridge-webcomponents` to build the core library.
 
 For more detailed development instructions, see [IMPLEMENTATION_GUIDELINES.md](IMPLEMENTATION_GUIDELINES.md), [AGENTS.md](AGENTS.md) and [CONTRIBUTING.md](CONTRIBUTING.md).