diff --git a/package_manager/core_packages.json b/package_manager/core_packages.json
deleted file mode 100644
index 1804b96aef831caadf38f3b2d2887d51e233c88b..0000000000000000000000000000000000000000
--- a/package_manager/core_packages.json
+++ /dev/null
@@ -1,9 +0,0 @@
-[
-  "drupal/core",
-  "drupal/core-composer-scaffold",
-  "drupal/core-dev",
-  "drupal/core-dev-pinned",
-  "drupal/core-project-message",
-  "drupal/core-recommended",
-  "drupal/core-vendor-hardening"
-]
diff --git a/package_manager/core_packages.yml b/package_manager/core_packages.yml
new file mode 100644
index 0000000000000000000000000000000000000000..d1b29edfd196e694ef64739a2f6818a3d42d87ea
--- /dev/null
+++ b/package_manager/core_packages.yml
@@ -0,0 +1,15 @@
+# This file exists so that \Drupal\package_manager\ComposerUtility can discern
+# which installed packages are considered part of Drupal core. There's no way
+# to tell by package type alone, since these packages have varying types, but
+# are all part of Drupal core's repository. This file is for internal use and
+# may be changed or removed at any time. Code external to Package Manager
+# should not use it in any way.
+[
+  drupal/core,
+  drupal/core-composer-scaffold,
+  drupal/core-dev,
+  drupal/core-dev-pinned,
+  drupal/core-project-message,
+  drupal/core-recommended,
+  drupal/core-vendor-hardening
+]
diff --git a/package_manager/src/ComposerUtility.php b/package_manager/src/ComposerUtility.php
index 325d1fce5227e3cd5a9b70cf7ef51cea89a9d70e..8b1fcec9dbe6c1a3150f87cee129020ee48f2e52 100644
--- a/package_manager/src/ComposerUtility.php
+++ b/package_manager/src/ComposerUtility.php
@@ -7,7 +7,6 @@ use Composer\Factory;
 use Composer\IO\NullIO;
 use Composer\Package\PackageInterface;
 use Composer\Semver\Comparator;
-use Drupal\Component\Serialization\Json;
 use Drupal\Component\Serialization\Yaml;
 
 /**
@@ -98,11 +97,11 @@ class ComposerUtility {
    */
   protected static function getCorePackageList(): array {
     if (self::$corePackages === NULL) {
-      $file = __DIR__ . '/../core_packages.json';
+      $file = __DIR__ . '/../core_packages.yml';
       assert(file_exists($file), "$file does not exist.");
 
       $core_packages = file_get_contents($file);
-      $core_packages = Json::decode($core_packages);
+      $core_packages = Yaml::decode($core_packages);
 
       assert(is_array($core_packages), "$file did not contain a list of core packages.");
       self::$corePackages = $core_packages;
diff --git a/package_manager/tests/src/Kernel/CorePackageManifestTest.php b/package_manager/tests/src/Kernel/CorePackageManifestTest.php
index 5d82264e8afc36c6770e1d808e99852ac7869376..f6b8e4ed299ccc57e456266fb64c21b03f56d1bf 100644
--- a/package_manager/tests/src/Kernel/CorePackageManifestTest.php
+++ b/package_manager/tests/src/Kernel/CorePackageManifestTest.php
@@ -3,6 +3,7 @@
 namespace Drupal\Tests\package_manager\Kernel;
 
 use Drupal\Component\Serialization\Json;
+use Drupal\Component\Serialization\Yaml;
 use Drupal\KernelTests\KernelTestBase;
 use Symfony\Component\Finder\Finder;
 
@@ -44,8 +45,8 @@ class CorePackageManifestTest extends KernelTestBase {
     sort($packages);
 
     // Ensure that the packages we detected matches the hard-coded list we ship.
-    $manifest = file_get_contents(__DIR__ . '/../../../core_packages.json');
-    $manifest = Json::decode($manifest);
+    $manifest = file_get_contents(__DIR__ . '/../../../core_packages.yml');
+    $manifest = Yaml::decode($manifest);
     $this->assertSame($packages, $manifest);
   }