diff --git a/.github/workflows/clp-rust-checks.yaml b/.github/workflows/clp-rust-checks.yaml
index 72e8281c1d..d0a52a00ae 100644
--- a/.github/workflows/clp-rust-checks.yaml
+++ b/.github/workflows/clp-rust-checks.yaml
@@ -31,6 +31,10 @@ jobs:
         shell: "bash"
         run: "npm install -g @go-task/cli@3.44.0"
 
+      - name: "Validate lock files"
+        shell: "bash"
+        run: "task deps:lock:check-rust"
+
       - name: "Lint"
         shell: "bash"
         run: "task lint:check-rust"
diff --git a/Cargo.lock b/Cargo.lock
index 85e254193a..4148d6f49a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2178,9 +2178,9 @@ checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
+checksum = "462eeb75aeb73aea900253ce739c8e18a67423fadf006037cd3ff27e82748a06"
 
 [[package]]
 name = "untrusted"
diff --git a/taskfiles/deps/lock.yaml b/taskfiles/deps/lock.yaml
new file mode 100644
index 0000000000..9d6830cb85
--- /dev/null
+++ b/taskfiles/deps/lock.yaml
@@ -0,0 +1,30 @@
+version: "3"
+
+includes:
+  toolchains: "../toolchains.yaml"
+
+tasks:
+  check-rust:
+    cmds:
+      - task: "cargo-workspace-update"
+        vars:
+          CARGO_UPDATE_FLAGS: "--locked"
+
+  update-rust:
+    cmds:
+      - task: "cargo-workspace-update"
+        vars:
+          CARGO_UPDATE_FLAGS: ""
+
+  # Runs `cargo update` in the root Rust workspace directory with the specified flags.
+  #
+  # @param {string} CARGO_UPDATE_FLAGS The flags to pass to the `cargo update` command.
+  cargo-workspace-update:
+    internal: true
+    requires:
+      vars: ["CARGO_UPDATE_FLAGS"]
+    dir: "{{.ROOT_DIR}}"
+    deps: ["toolchains:rust"]
+    cmd: |-
+      . "$HOME/.cargo/env"
+      cargo update {{.CARGO_UPDATE_FLAGS}}
diff --git a/taskfiles/deps/main.yaml b/taskfiles/deps/main.yaml
index 9a6b0ab478..bbfbc71007 100644
--- a/taskfiles/deps/main.yaml
+++ b/taskfiles/deps/main.yaml
@@ -1,6 +1,7 @@
 version: "3"
 
 includes:
+  lock: "./lock.yaml"
   utils: "./utils.yaml"
   yscope-dev-utils: "../../tools/yscope-dev-utils/exports/taskfiles/utils/utils.yaml"