diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 19b4885..d81b1f9 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -47,7 +47,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync
+      run: uv sync --locked
 
     - name: Generate coverage report
       run: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 028e543..f20ac4f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync --group dev --extra jwt
+      run: uv sync --locked --group dev --extra jwt
 
     # `tests` is linted here too. pre-commit only sees staged files, so test
     # code that was never touched again drifts; that is how the suite came to
diff --git a/.github/workflows/lowest.yml b/.github/workflows/lowest.yml
index 64e7022..fa23186 100644
--- a/.github/workflows/lowest.yml
+++ b/.github/workflows/lowest.yml
@@ -51,7 +51,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync
+      run: uv sync --locked
 
     - name: Test with the lowest direct dependencies
       run: uv run tox -e lowest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5710f2..e253a31 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -106,7 +106,7 @@ jobs:
       # a missing backend package would turn the gate below into a formality,
       # so it does not rely on a dev-group entry staying put.
       - name: Sync dependencies
-        run: uv sync --group dev --extra jwt --extra redis --extra memcached
+        run: uv sync --locked --group dev --extra jwt --extra redis --extra memcached
 
       # The gate. A release is the one run where a red test result arrives too
       # late to matter, so everything CI checks elsewhere is checked here too,
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9456603..1256128 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -54,7 +54,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync --extra jwt
+      run: uv sync --locked --extra jwt
 
     - name: Run tests
       run: uv run coverage run -m pytest && uv run coverage report
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index 5df9262..6dfacb1 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -195,7 +195,10 @@ The hooks cover the standard pre-commit-hooks checks, `ruff` (with `--fix`) and
 `docs/` and `scripts/`). They run automatically on `git commit`. If any checks fail, fix the issues and try committing again.
 `uv-lock` only re-resolves the lockfile when `pyproject.toml` changed; it does not
 upgrade pinned versions. Upgrades come from Renovate or an explicit
-`uv lock --upgrade`.
+`uv lock --upgrade`. Every CI workflow installs with `uv sync --locked`, which
+fails when `uv.lock` does not match `pyproject.toml`, so a pull request that
+changes a dependency without committing the relocked `uv.lock` goes red
+instead of quietly re-resolving on the runner.
 
 pre-commit only sees the files you touched. The **Lint** workflow checks the
 whole tree; run the same commands before pushing: