diff --git a/README.md b/README.md
index 9b920d4..3a951dc 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,12 @@ imported to begin:
 import verifyTruepicWebhook from '@truepic/webhook-verifier'
 ```
 
+CommonJS is also supported:
+
+```js
+const verifyTruepicWebhook = require('@truepic/webhook-verifier')
+```
+
 This `verifyTruepicWebhook` function (or whatever you imported it as) is then
 called with the following arguments:
 
diff --git a/eslint.config.js b/eslint.config.js
index 57b2214..89fa851 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -1,12 +1,13 @@
-import js from '@eslint/js'
-import prettier from 'eslint-config-prettier'
-import node from 'eslint-plugin-n'
-import globals from 'globals'
+const js = require('@eslint/js')
+const prettier = require('eslint-config-prettier')
+const node = require('eslint-plugin-n')
+const globals = require('globals')
 
-export default [
+module.exports = [
   {
     languageOptions: {
       globals: { ...globals.node },
+      sourceType: 'commonjs',
     },
   },
   {
diff --git a/package.json b/package.json
index 2f3ab6c..5480b8c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,6 @@
 {
   "name": "@truepic/webhook-verifier",
   "version": "1.4.0",
-  "type": "module",
   "description": "Verify webhooks from Truepic Vision or Lens in your Node.js app",
   "homepage": "https://github.com/TRUEPIC/webhook-verifier-nodejs#readme",
   "bugs": "https://github.com/TRUEPIC/webhook-verifier-nodejs/issues",
diff --git a/src/error.js b/src/error.js
index 3abdae3..1bcb5e1 100644
--- a/src/error.js
+++ b/src/error.js
@@ -19,4 +19,4 @@ class TruepicWebhookVerifierError extends Error {
   }
 }
 
-export default TruepicWebhookVerifierError
+module.exports = TruepicWebhookVerifierError
diff --git a/src/main.js b/src/main.js
index 42a8ef0..92d1913 100644
--- a/src/main.js
+++ b/src/main.js
@@ -1,5 +1,5 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
-import TruepicWebhookVerifierError from './error.js'
+const { createHmac, timingSafeEqual } = require('node:crypto')
+const TruepicWebhookVerifierError = require('./error')
 
 /**
  * Parse the `truepic-signature` header into timestamp and signature values.
@@ -164,5 +164,5 @@ function verifyTruepicWebhook({
 }
 
 /** @module @truepic/webhook-verifier */
-export default verifyTruepicWebhook
-export { TruepicWebhookVerifierError }
+module.exports = verifyTruepicWebhook
+module.exports.TruepicWebhookVerifierError = TruepicWebhookVerifierError
diff --git a/src/main.test.js b/src/main.test.js
index 90a56a6..f683967 100644
--- a/src/main.test.js
+++ b/src/main.test.js
@@ -1,6 +1,8 @@
-import assert from 'node:assert/strict'
-import { describe, it } from 'node:test'
-import verifyTruepicWebhook, { TruepicWebhookVerifierError } from './main.js'
+const assert = require('node:assert/strict')
+const { describe, it } = require('node:test')
+const verifyTruepicWebhook = require('./main')
+
+const { TruepicWebhookVerifierError } = verifyTruepicWebhook
 
 describe('verifyTruepicWebhook', () => {
   // Successful values.