diff --git a/lib/datasource/npm.js b/lib/datasource/npm.js
index 2625fe6bde943459c51e32dda9c6507c889def06..37308538811041462b4e111aa17ef2f443d4f785 100644
--- a/lib/datasource/npm.js
+++ b/lib/datasource/npm.js
@@ -133,11 +133,14 @@ async function getPreset(pkgName, presetName = 'default') {
 }
 
 async function getDependency(name, retries = 5) {
-  logger.trace(`getPkgReleases(${name})`);
+  logger.trace(`npm.getPkgReleases(${name})`);
+
+  // This is our datastore cache and is cleared at the end of each repo, i.e. we never requery/revalidate during a "run"
   if (memcache[name]) {
     logger.trace('Returning cached result');
     return memcache[name];
   }
+
   const scope = name.split('/')[0];
   let regUrl;
   try {
@@ -173,7 +176,9 @@ async function getDependency(name, retries = 5) {
     delete headers.authorization;
   }
 
-  // Retrieve from API if not cached
+  // This tells our http layer not to serve responses directly from the cache and instead to revalidate them every time
+  headers['Cache-Control'] = 'no-cache';
+
   try {
     const raw = await got(pkgUrl, {
       cache: process.env.RENOVATE_SKIP_CACHE ? undefined : map,