diff --git a/CLAUDE.md b/CLAUDE.md
index d9fb92b..203cd9c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -68,7 +68,8 @@ None of these were discoverable locally — there's no npm here (see "Local-only
 
 - **`vite` version must satisfy `@nextcloud/vite-config`'s peer requirement.** `package.json` pins `@nextcloud/vite-config` to `^2.2.0`, which currently resolves to `2.5.4` and peer-requires `vite@^7.3.6`. If you bump `@nextcloud/vite-config`, check its `peerDependencies.vite` and bump our `vite` devDependency to match, or `npm install` fails with `ERESOLVE`.
 - **`package.json` needs `"type": "module"`.** `vite.config.js` uses `import`/`export` syntax and `@nextcloud/vite-config` is ESM-only; without `"type": "module"`, Node treats `.js` as CommonJS and `vite build` fails trying to `require()` an ESM-only package.
-- **A `tsconfig.json` must exist at the repo root, even though this project has no TypeScript source.** `@nextcloud/vite-config`'s `index.js` barrel statically re-exports `createLibConfig` from `libConfig.js`, which imports `vite-plugin-dts` at module scope — that import chain runs just from importing `createAppConfig`, regardless of whether `createLibConfig` is ever called. `vite-plugin-dts`/`@volar/typescript` crash (`Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')`) while loading `vite.config.js` if there's no tsconfig for it to resolve. The minimal `tsconfig.json` in this repo exists solely to satisfy that, not because we write TypeScript.
+- **A `tsconfig.json` must exist at the repo root, even though this project has no TypeScript source.** `@nextcloud/vite-config`'s `index.js` barrel statically re-exports `createLibConfig` from `libConfig.js`, which imports `vite-plugin-dts` at module scope — that import chain runs just from importing `createAppConfig`, regardless of whether `createLibConfig` is ever called. The minimal `tsconfig.json` in this repo exists to give that a config to resolve, not because we write TypeScript. On its own this did **not** fix the crash below — see the next bullet.
+- **`typescript` must be an explicit devDependency.** `vite-plugin-dts` (pulled in transitively by the bullet above, version `^4.5.4` as of `@nextcloud/vite-config@2.5.4`) peer-depends on `typescript: "*"` but doesn't install it itself. Without a `typescript` devDependency in our own `package.json`, nothing provides that package, and `vite-plugin-dts`'s `@volar/typescript` integration crashes at module-load time — before `vite.config.js`'s own code or `tsconfig.json` are ever consulted — with `Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')` (`proxyCreateProgram`). This is the actual fix; `tsconfig.json` existing is necessary but not sufficient. Keep `typescript` reasonably close to the version `@nextcloud/vite-config` itself develops against (currently `^5.9.3`) if you bump either.
 
 ## Local-only notes
 
diff --git a/package.json b/package.json
index 37e7528..42fc7c1 100644
--- a/package.json
+++ b/package.json
@@ -20,6 +20,7 @@
 	"devDependencies": {
 		"@nextcloud/browserslist-config": "^3.0.1",
 		"@nextcloud/vite-config": "^2.2.0",
+		"typescript": "^5.9.3",
 		"vite": "^7.3.6"
 	},
 	"engines": {