diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fad74a31a..45b0187db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
       - uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918
         with:
-          arguments: --all-features --workspace
+          arguments: --workspace --all-features --locked
           command: check
           command-arguments: "-Dwarnings"
 
diff --git a/scripts/deny.sh b/scripts/deny.sh
index 05c508b23..94232e3eb 100755
--- a/scripts/deny.sh
+++ b/scripts/deny.sh
@@ -3,4 +3,4 @@
 # Update package cache without changing the lockfile.
 cargo update --dry-run
 
-cargo deny --workspace --all-features check -D warnings
+cargo deny --workspace --all-features --locked check -D warnings