diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8a11973..b8340c60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,15 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## Unreleased
 
+### Changed
+* **Breaking** (technically): `buildDepsOnly`, `buildPackage`, `cargoBuild`,
+  `cargoClippy`, `cargoDoc`, `cargoLlvmCov`, and `cargoTest`'s defaults have
+  been changed such that if `cargoExtraArgs` have not been set, a default value
+  of `--locked` will be used. This ensures that a project's committed
+  `Cargo.lock` is exactly what is expected (without implicit changes at build
+  time) but this may end up rejecting builds which were previously passing. To
+  get the old behavior back, set `cargoExtraArgs = "";`
+
 ## [0.13.1] - 2023-08-22
 
 ### Changed
diff --git a/checks/default.nix b/checks/default.nix
index a1fcf675..41de838c 100644
--- a/checks/default.nix
+++ b/checks/default.nix
@@ -76,6 +76,7 @@ in
             sha256 = "sha256-sNwizxYVUNyv5InR8HS+CyUsroA79h/FpouS+fMWJUI=";
           };
 
+          cargoExtraArgs = "--offline";
           doCheck = false; # Tests need llvm-tools installed
           buildInputs = lib.optionals isDarwin [
             pkgs.libiconv
@@ -576,6 +577,7 @@ in
     postUnpack = ''
       cd $sourceRoot/workspace
       sourceRoot="."
+      [[ -f Cargo.lock ]] || ln ../Cargo.lock
     '';
     cargoLock = ./workspace-not-at-root/workspace/Cargo.lock;
     cargoToml = ./workspace-not-at-root/workspace/Cargo.toml;
diff --git a/docs/API.md b/docs/API.md
index 3c69eed3..ad731366 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -113,7 +113,7 @@ to influence its behavior.
   - Default value: `"--all-targets"` if `doCheck` is set to true, `""` otherwise
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation (e.g.
   enabling specific features)
-  - Default value: `""`
+  - Default value: `"--locked"`
 * `cargoTestCommand`: A cargo invocation to run during the derivation's check
   phase
   - Default value: `"cargo test --profile release"`
@@ -197,7 +197,7 @@ install hooks.
       altogether.
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation (e.g.
   enabling specific features)
-  - Default value: `""`
+  - Default value: `"--locked"`
 * `cargoTestCommand`: A cargo invocation to run during the derivation's check
   phase
   - Default value: `"cargo test --profile release"`
@@ -363,7 +363,7 @@ Except where noted below, all derivation attributes are delegated to
 #### Optional attributes
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation (e.g.
   enabling specific features)
-  - Default value: `""`
+  - Default value: `"--locked"`
 
 #### Remove attributes
 The following attributes will be removed before being lowered to
@@ -403,7 +403,7 @@ Except where noted below, all derivation attributes are delegated to
   - Default value: `"--all-targets"`
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation (e.g.
   enabling specific features)
-  - Default value: `""`
+  - Default value: `"--locked"`
 
 #### Native build dependencies
 The `clippy` package is automatically appended as a native build input to any
@@ -447,7 +447,7 @@ Except where noted below, all derivation attributes are delegated to
   - Default value: `"--no-deps"`
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation (e.g.
   enabling specific features)
-  - Default value: `""`
+  - Default value: `"--locked"`
 
 #### Remove attributes
 The following attributes will be removed before being lowered to
@@ -517,7 +517,7 @@ Except where noted below, all derivation attributes are delegated to
 
 #### Optional attributes
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation
-  - Default value: `""`
+  - Default value: `"--locked"`
 * `cargoLlvmCovCommand`: cargo-llvm-cov command to run
   - Default value: `"test"`
 * `cargoLlvmCovExtraArgs`: additional flags to be passed in the cargo
@@ -653,7 +653,7 @@ Except where noted below, all derivation attributes are delegated to
 
 #### Optional attributes
 * `cargoExtraArgs`: additional flags to be passed in the cargo invocation
-  - Default value: `""`
+  - Default value: `"--locked"`
 * `cargoTestArgs`: additional flags to be passed in the cargo
   invocation
   - Default value: `""`
diff --git a/lib/buildDepsOnly.nix b/lib/buildDepsOnly.nix
index f384dbd9..1fa4afd0 100644
--- a/lib/buildDepsOnly.nix
+++ b/lib/buildDepsOnly.nix
@@ -7,7 +7,7 @@
 
 { cargoBuildCommand ? "cargoWithProfile build"
 , cargoCheckCommand ? "cargoWithProfile check"
-, cargoExtraArgs ? ""
+, cargoExtraArgs ? "--locked"
 , cargoTestCommand ? "cargoWithProfile test"
 , cargoTestExtraArgs ? ""
 , ...
diff --git a/lib/buildPackage.nix b/lib/buildPackage.nix
index caa72f65..68181873 100644
--- a/lib/buildPackage.nix
+++ b/lib/buildPackage.nix
@@ -9,7 +9,7 @@
 }:
 
 { cargoBuildCommand ? "cargoWithProfile build"
-, cargoExtraArgs ? ""
+, cargoExtraArgs ? "--locked"
 , cargoTestCommand ? "cargoWithProfile test"
 , cargoTestExtraArgs ? ""
 , ...
diff --git a/lib/cargoBuild.nix b/lib/cargoBuild.nix
index 4e0a323d..6b3299bd 100644
--- a/lib/cargoBuild.nix
+++ b/lib/cargoBuild.nix
@@ -2,7 +2,7 @@
 }:
 
 { cargoArtifacts
-, cargoExtraArgs ? ""
+, cargoExtraArgs ? "--locked"
 , ...
 }@origArgs:
 let
diff --git a/lib/cargoClippy.nix b/lib/cargoClippy.nix
index 1acf5c07..3d9f3a68 100644
--- a/lib/cargoClippy.nix
+++ b/lib/cargoClippy.nix
@@ -4,7 +4,7 @@
 
 { cargoArtifacts
 , cargoClippyExtraArgs ? "--all-targets"
-, cargoExtraArgs ? ""
+, cargoExtraArgs ? "--locked"
 , ...
 }@origArgs:
 let
diff --git a/lib/cargoDoc.nix b/lib/cargoDoc.nix
index bce9f5b2..b0b4c2d9 100644
--- a/lib/cargoDoc.nix
+++ b/lib/cargoDoc.nix
@@ -2,7 +2,7 @@
 }:
 
 { cargoDocExtraArgs ? "--no-deps"
-, cargoExtraArgs ? ""
+, cargoExtraArgs ? "--locked"
 , ...
 }@origArgs:
 let
diff --git a/lib/cargoLlvmCov.nix b/lib/cargoLlvmCov.nix
index e35799ac..d2e2b935 100644
--- a/lib/cargoLlvmCov.nix
+++ b/lib/cargoLlvmCov.nix
@@ -2,7 +2,7 @@
 , cargo-llvm-cov
 }:
 
-{ cargoExtraArgs ? ""
+{ cargoExtraArgs ? "--locked"
 , cargoLlvmCovCommand ? "test"
 , cargoLlvmCovExtraArgs ? "--lcov --output-path $out"
 , ...
diff --git a/lib/cargoTest.nix b/lib/cargoTest.nix
index 183012b0..f110a246 100644
--- a/lib/cargoTest.nix
+++ b/lib/cargoTest.nix
@@ -2,7 +2,7 @@
 }:
 
 { cargoArtifacts
-, cargoExtraArgs ? ""
+, cargoExtraArgs ? "--locked"
 , cargoTestExtraArgs ? ""
 , ...
 }@origArgs: