diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 954505ac..bda21e9d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -68,7 +68,7 @@ jobs:
       - if: ${{ runner.os == 'Linux' }}
         name: Pre-install cross
         run: |
-          cargo install --bins --git https://github.com/rust-embedded/cross --tag v${{ env.CROSS_VERSION }} cross
+          cargo install --bins --git https://github.com/rust-embedded/cross --locked --tag v${{ env.CROSS_VERSION }} cross
 
   tests:
     name: Run tests
@@ -163,7 +163,7 @@ jobs:
         shell: sh
         run: |
           if [ -n "${{ matrix.use_cross }}" ]; then
-            cargo install --bins --git https://github.com/rust-embedded/cross --tag v${{ env.CROSS_VERSION }} cross
+            cargo install --bins --git https://github.com/rust-embedded/cross --locked --tag v${{ env.CROSS_VERSION }} cross
             # Required for compatibility with manylinux2014.
             # https://github.com/briansmith/ring/issues/1728
             if [ "${{ matrix.architecture }}" = "linux-aarch64" ]; then
@@ -399,6 +399,7 @@ jobs:
   build-android:
     name: Build library (Android)
     needs: [checks]
+    # NB: RUST_VERSION must be <1.68 here to support NDK 17
     env:
       RUST_VERSION: "1.67"
 
@@ -431,7 +432,7 @@ jobs:
 
       - name: Build
         run: |
-          cargo install --bins --git https://github.com/rust-embedded/cross --tag v${{ env.CROSS_VERSION }} cross
+          cargo install --bins --git https://github.com/rust-embedded/cross --locked --tag v${{ env.CROSS_VERSION }} cross
           # Required for compatibility with manylinux2014:
           # https://github.com/briansmith/ring/issues/1728
           if [ "${{ matrix.target }}" = "aarch64-linux-android" ]; then