diff --git a/lib/datasource/packagist.js b/lib/datasource/packagist.js
index 66f9ff16e59c4249dfa99a19a066034766e98167..09f3fb2a73d2b96d09fda9e695a608472c731707 100644
--- a/lib/datasource/packagist.js
+++ b/lib/datasource/packagist.js
@@ -3,6 +3,7 @@ const URL = require('url');
 const delay = require('delay');
 const got = require('got');
 const parse = require('github-url-from-git');
+const pAll = require('p-all');
 const { isVersion, sortVersions } = require('../versioning')('semverComposer');
 const hostRules = require('../util/host-rules');
 
@@ -132,10 +133,10 @@ async function getAllPackages(regUrl) {
   }
   const { packages, providersUrl, files, includesFiles } = registryMeta;
   const providerPackages = {};
-  // TODO: refactor the following to be in parallel
   if (files) {
-    for (const file of files) {
-      const res = await getPackagistFile(regUrl, file);
+    const queue = files.map(file => () => getPackagistFile(regUrl, file));
+    const resolvedFiles = await pAll(queue, { concurrency: 5 });
+    for (const res of resolvedFiles) {
       for (const [name, val] of Object.entries(res.providers)) {
         providerPackages[name] = val.sha256;
       }