diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cc5c653..35b0964 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - run: cargo check
+      - run: cargo check --locked
 
   check-wasm:
     name: Cargo Check (WASM)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8ab17e3..91208ed 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,6 +24,8 @@ cargo test
 make test-integration
 ```
 
+`Cargo.lock` is committed and CI runs `cargo check --locked`, so commit lockfile changes alongside any dependency change. The release PR bumps the workspace members' entries in `Cargo.lock` itself (see `release-please-config.json`), so a release never leaves the lockfile stale.
+
 ## Release Process
 
 ### Publishable Crates
diff --git a/release-please-config.json b/release-please-config.json
index a9275d7..bf0c09b 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -44,6 +44,11 @@
           "type": "toml",
           "path": "Cargo.toml",
           "jsonpath": "$.workspace.dependencies.multistore-path-mapping.version"
+        },
+        {
+          "type": "toml",
+          "path": "Cargo.lock",
+          "jsonpath": "$.package[?(!@.source)].version"
         }
       ]
     }