diff --git a/.dockerignore b/.dockerignore
index 0667d8870e..8a3d32e6d2 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,7 @@
 **/.pytest_cache
 
 .git
+.github
 target
 tmp_check
 tmp_install
diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 6e570b22d4..bf6eb69930 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -95,11 +95,11 @@ jobs:
           if [[ $BUILD_TYPE == "debug" ]]; then
             cov_prefix="scripts/coverage --profraw-prefix=$GITHUB_JOB --dir=/tmp/coverage run"
             CARGO_FEATURES=""
-            CARGO_FLAGS=""
+            CARGO_FLAGS="--locked"
           elif [[ $BUILD_TYPE == "release" ]]; then
             cov_prefix=""
             CARGO_FEATURES="--features profiling"
-            CARGO_FLAGS="--release $CARGO_FEATURES"
+            CARGO_FLAGS="--locked --release $CARGO_FEATURES"
           fi
           echo "cov_prefix=${cov_prefix}" >> $GITHUB_ENV
           echo "CARGO_FEATURES=${CARGO_FEATURES}" >> $GITHUB_ENV
diff --git a/.github/workflows/codestyle.yml b/.github/workflows/codestyle.yml
index eddfee88fc..b64ea8a01f 100644
--- a/.github/workflows/codestyle.yml
+++ b/.github/workflows/codestyle.yml
@@ -110,7 +110,7 @@ jobs:
         run: ./run_clippy.sh
 
       - name: Ensure all project builds
-        run: cargo build --all --all-targets
+        run: cargo build --locked --all --all-targets
 
   check-codestyle-python:
     runs-on: [ self-hosted, Linux, k8s-runner ]
diff --git a/Dockerfile b/Dockerfile
index 77598fd086..2dbe71f1ad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,7 +40,7 @@ COPY . .
 # Show build caching stats to check if it was used in the end.
 # Has to be the part of the same RUN since cachepot daemon is killed in the end of this RUN, losing the compilation stats.
 RUN set -e \
-    && mold -run cargo build --release \
+&& mold -run cargo build --locked --release \
     && cachepot -s
 
 # Build final image
diff --git a/Dockerfile.compute-node b/Dockerfile.compute-node
index 4527fb9ece..057441e730 100644
--- a/Dockerfile.compute-node
+++ b/Dockerfile.compute-node
@@ -69,9 +69,9 @@ RUN make -j $(getconf _NPROCESSORS_ONLN) \
 # Compile and run the Neon-specific `compute_ctl` binary
 FROM 369495373322.dkr.ecr.eu-central-1.amazonaws.com/rust:$TAG AS compute-tools
 USER nonroot
-COPY --chown=nonroot compute_tools compute_tools
-COPY --chown=nonroot workspace_hack workspace_hack
-RUN cd compute_tools && cargo build --release
+# Copy entire project to get Cargo.* files with proper dependencies for the whole project
+COPY --chown=nonroot . .
+RUN cd compute_tools && cargo build --locked --release
 
 # Put it all together into the final image
 FROM debian:bullseye-slim
@@ -86,7 +86,7 @@ RUN mkdir /var/db && useradd -m -d /var/db/postgres postgres && \
 # TODO: Check if we can make the extension setup more modular versus a linear build
 # currently plv8-build copies the output /usr/local/pgsql from postgis-build, etc#
 COPY --from=neon-pg-ext-build --chown=postgres /usr/local/pgsql /usr/local
-COPY --from=compute-tools --chown=postgres /home/nonroot/compute_tools/target/release/compute_ctl /usr/local/bin/compute_ctl
+COPY --from=compute-tools --chown=postgres /home/nonroot/target/release/compute_ctl /usr/local/bin/compute_ctl
 
 RUN apt update &&  \
     apt install -y libreadline-dev libossp-uuid-dev gdal-bin libgdal-dev libprotobuf-c-dev && \
@@ -103,4 +103,4 @@ RUN echo "deb http://ftp.debian.org/debian testing main" >> /etc/apt/sources.lis
 RUN ln -s /usr/local/bin/compute_ctl /usr/local/bin/zenith_ctl
 
 USER postgres
-ENTRYPOINT ["/usr/local/bin/compute_ctl"]
\ No newline at end of file
+ENTRYPOINT ["/usr/local/bin/compute_ctl"]
diff --git a/Dockerfile.compute-tools b/Dockerfile.compute-tools
index 47c408bbf2..8231cd0ebb 100644
--- a/Dockerfile.compute-tools
+++ b/Dockerfile.compute-tools
@@ -20,7 +20,7 @@ ARG CACHEPOT_BUCKET=neon-github-dev
 COPY . .
 
 RUN set -e \
-    && mold -run cargo build -p compute_tools --release \
+    && mold -run cargo build -p compute_tools --locked --release \
     && cachepot -s
 
 # Final image that only has one binary
diff --git a/run_clippy.sh b/run_clippy.sh
index 13af3fd2c5..9feb8de4ea 100755
--- a/run_clippy.sh
+++ b/run_clippy.sh
@@ -13,10 +13,10 @@
 # avoid running regular linting script that checks every feature.
 if [[ "$OSTYPE" == "darwin"* ]]; then
     # no extra features to test currently, add more here when needed
-    cargo clippy --all --all-targets -- -A unknown_lints -D warnings
+    cargo clippy --locked --all --all-targets -- -A unknown_lints -D warnings
 else
     # * `-A unknown_lints` – do not warn about unknown lint suppressions
     #                        that people with newer toolchains might use
     # * `-D warnings`      - fail on any warnings (`cargo` returns non-zero exit status)
-    cargo clippy --all --all-targets --all-features -- -A unknown_lints -D warnings
+    cargo clippy --locked --all --all-targets --all-features -- -A unknown_lints -D warnings
 fi