diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4c1b791dba..65d91ffc9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -232,7 +232,7 @@ jobs:
       - name: Install nightly toolchain
         run: rustup toolchain install nightly --profile minimal
       - name: Install rustup-toolchain-install-master
-        run: cargo install -f rustup-toolchain-install-master
+        run: cargo install --locked -f rustup-toolchain-install-master
       # Create a token for the next step so it can create a PR that actually runs CI.
       - uses: actions/create-github-app-token@v3
         id: app-token
diff --git a/.github/workflows/setup/action.yml b/.github/workflows/setup/action.yml
index a6c591154a..cc00ec71a6 100644
--- a/.github/workflows/setup/action.yml
+++ b/.github/workflows/setup/action.yml
@@ -38,7 +38,7 @@ runs:
 
       - name: Install the tools we need
         if: steps.cache.outputs.cache-hit != 'true'
-        run: cargo install -f rustup-toolchain-install-master hyperfine
+        run: cargo install --locked -f rustup-toolchain-install-master hyperfine
         shell: bash
 
       - name: Install "master" toolchain
diff --git a/.github/workflows/sysroots.yml b/.github/workflows/sysroots.yml
index a488e480c0..a8a9306a50 100644
--- a/.github/workflows/sysroots.yml
+++ b/.github/workflows/sysroots.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Build the sysroots
         run: |
           rustup toolchain install nightly
-          cargo install -f rustup-toolchain-install-master
+          cargo install --locked -f rustup-toolchain-install-master
           ./miri toolchain -c rust-docs # Docs are the only place targets are separated by tier
           ./miri install
           python3 -m pip install beautifulsoup4
diff --git a/.gitpod.yml b/.gitpod.yml
index 724cf26df2..507fbff567 100644
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -3,7 +3,7 @@ image: ubuntu:latest
 tasks:
   - before: echo "..."
     init: |
-      cargo install rustup-toolchain-install-master
+      cargo install --locked rustup-toolchain-install-master
       ./miri toolchain
       ./miri build
     command: echo "Run tests with ./miri test"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4524f79456..0a330cdd45 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -252,7 +252,7 @@ and on macOS, `rm -rf ~/Library/Caches/org.rust-lang.miri`).
 
 Miri comes with a few benchmarks; you can run `./miri bench` to run them with the locally built
 Miri. Note: this will run `./miri install` as a side-effect. Also requires `hyperfine` to be
-installed (`cargo install hyperfine`).
+installed (`cargo install --locked hyperfine`).
 
 To compare the benchmark results with a baseline, do the following:
 - Before applying your changes, run `./miri bench --save-baseline=baseline.json`.
diff --git a/miri-script/src/commands.rs b/miri-script/src/commands.rs
index 0a372dfbf0..e8fdcd80f8 100644
--- a/miri-script/src/commands.rs
+++ b/miri-script/src/commands.rs
@@ -158,7 +158,7 @@ impl Command {
 
         cmd!(sh, "rustup-toolchain-install-master -n miri -c cargo -c rust-src -c rustc-dev -c llvm-tools -c rustfmt -c clippy {flags...} -- {new_commit}")
             .run()
-            .context("Failed to run rustup-toolchain-install-master. If it is not installed, run 'cargo install rustup-toolchain-install-master'.")?;
+            .context("Failed to run rustup-toolchain-install-master. If it is not installed, run 'cargo install --locked rustup-toolchain-install-master'.")?;
         cmd!(sh, "rustup override set miri").run()?;
         // Cleanup.
         cmd!(sh, "cargo clean").run()?;