diff --git a/release.sh b/release.sh
index c2d8a134434..f382efcbeff 100755
--- a/release.sh
+++ b/release.sh
@@ -154,7 +154,15 @@ echo "npm version"
 # only turn off both of these behaviours, so we have to
 # manually commit the result.
 npm version --no-git-tag-version "$release"
-git commit package.json -m "$tag"
+
+# commit package-lock.json if it exists and is versioned
+if [[ -f package-lock.json && -z `git st --porcelain --ignored package-lock.json` ]];
+then
+    pkglock='package-lock.json'
+else
+    pkglock=''
+fi
+git commit package.json $pkglock -m "$tag"
 
 
 # figure out if we should be signing this release