diff --git a/.github/workflows/autopublish.yaml b/.github/workflows/autopublish.yaml
index abb9b521f1a5..0f510ecf4723 100644
--- a/.github/workflows/autopublish.yaml
+++ b/.github/workflows/autopublish.yaml
@@ -28,7 +28,7 @@ jobs:
         run: rustup update --no-self-update stable
 
       - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces --version "0.3.6"
+        run: cargo install --locked cargo-workspaces --version "0.3.6"
 
       - name: Publish Crates
         env:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 14582f8405f5..d227ec2e41b6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -50,7 +50,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Install rustup-toolchain-install-master
-        run: cargo install rustup-toolchain-install-master@1.11.0
+        run: cargo install --locked rustup-toolchain-install-master@1.11.0
 
       # Install a pinned rustc commit to avoid surprises
       - name: Install Rust toolchain
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index af0e03598ecf..1c3ad1cd2221 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -38,6 +38,6 @@ jobs:
 
       - name: Build fuzzers
         run: |
-          cargo install cargo-fuzz
+          cargo install --locked cargo-fuzz
           cd crates/syntax
           cargo +nightly fuzz build
diff --git a/.github/workflows/publish-libs.yaml b/.github/workflows/publish-libs.yaml
index 762b7bda871c..ff04f1b83066 100644
--- a/.github/workflows/publish-libs.yaml
+++ b/.github/workflows/publish-libs.yaml
@@ -22,7 +22,7 @@ jobs:
         run: rustup update --no-self-update stable
 
       - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces --version "0.3.6"
+        run: cargo install --locked cargo-workspaces --version "0.3.6"
 
       - name: Publish Crates
         env:
diff --git a/docs/book/README.md b/docs/book/README.md
index cd4d8783a4d2..229180226999 100644
--- a/docs/book/README.md
+++ b/docs/book/README.md
@@ -7,7 +7,7 @@ The rust analyzer manual uses [mdbook](https://rust-lang.github.io/mdBook/).
 To run the documentation site locally:
 
 ```bash
-cargo install mdbook
+cargo install --locked mdbook
 cargo xtask codegen
 cd docs/book
 mdbook serve
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 764cc09ded6c..dbfc39534c67 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -72,7 +72,7 @@ fn run_fuzzer(sh: &Shell) -> anyhow::Result<()> {
     let _d = sh.push_dir("./crates/syntax");
     let _e = sh.push_env("RUSTUP_TOOLCHAIN", "nightly");
     if cmd!(sh, "cargo fuzz --help").read().is_err() {
-        cmd!(sh, "cargo install cargo-fuzz").run()?;
+        cmd!(sh, "cargo install --locked cargo-fuzz").run()?;
     };
 
     // Expecting nightly rustc