diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 1727c29b..95eda466 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -152,7 +152,7 @@ jobs:
         uses: dtolnay/rust-toolchain@nightly
 
       - name: cargo test (debug; all features; -Z minimal-versions)
-        run: cargo -Z minimal-versions test --all-features
+        run: cargo -Z minimal-versions test --all-features --locked
 
   format:
     name: Format
@@ -190,7 +190,7 @@ jobs:
         # (below) will have a new lint that we want to suppress.
         # If we suppress (e.g. #![allow(clippy::arc_with_non_send_sync)]),
         # we would get an unknown-lint error from older clippy versions.
-        run: cargo clippy --workspace -- -D warnings -A unknown-lints
+        run: cargo clippy --locked --workspace -- -D warnings -A unknown-lints
 
   clippy-nightly-optional:
     name: Clippy nightly (optional)
@@ -205,7 +205,7 @@ jobs:
         with:
           components: clippy
       - name: Check clippy
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --locked --workspace -- -D warnings
 
   clang-tidy:
     name: Clang Tidy
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8accfe2e..d36799f9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -11,7 +11,7 @@ ExternalProject_Add(
 	DOWNLOAD_COMMAND ""
 	CONFIGURE_COMMAND ""
 	BUILD_COMMAND cbindgen --lang C --output "${CMAKE_SOURCE_DIR}/src/rustls.h" "${CMAKE_SOURCE_DIR}"
-	COMMAND cargo build "$<IF:$<CONFIG:Release>,--release,-->"
+	COMMAND cargo build --locked "$<IF:$<CONFIG:Release>,--release,-->"
 	# Rely on cargo checking timestamps, rather than tell CMake where every
 	# output is.
 	BUILD_ALWAYS true
@@ -20,5 +20,5 @@ ExternalProject_Add(
 	# of "error" in stdout as an error, and we have some test functions that
 	# end in "_error". Quiet mode suppresses test names, so this is a
 	# sufficient workaround.
-	TEST_COMMAND cargo test "$<IF:$<CONFIG:Release>,--release,-->" --quiet
+	TEST_COMMAND cargo test --locked "$<IF:$<CONFIG:Release>,--release,-->" --quiet
 )
diff --git a/Makefile b/Makefile
index def7bf37..8e403565 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,7 @@ else
 endif
 
 CARGO ?= cargo
+CARGOFLAGS += --locked
 
 CFLAGS := -Werror -Wall -Wextra -Wpedantic -g -I src/
 PROFILE := release
@@ -32,7 +33,7 @@ test: all test-rust
 	./tests/client-server.py ./target/client ./target/server
 
 test-rust:
-	${CARGO} test
+	${CARGO} test --locked
 
 target:
 	mkdir -p $@
diff --git a/Makefile.Windows b/Makefile.Windows
index 59b60f97..8f22827b 100644
--- a/Makefile.Windows
+++ b/Makefile.Windows
@@ -38,11 +38,11 @@ test: all
 	$(call green_msg, getting 'https://httpbin.org/headers' ...)
 	target/client.exe httpbin.org 443 /headers
 	$(call green_msg, Running 'cargo test')
-	cargo test
+	cargo test --locked
 
 $(RUSTLS_LIB): src/lib.rs Cargo.toml
 	$(call green_msg, Building '$@')
-	RUSTFLAGS="--print native-static-libs" cargo build --release
+	RUSTFLAGS="--print native-static-libs" cargo build --release --locked
 	@echo
 
 %.obj: tests/%.c