diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 27f60b0..e903edc 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -625,6 +625,9 @@ jobs:
         run: |
           python3 scripts/fetch-pdf-test-fonts.py "$RUNNER_TEMP/craft-pdf-test-fonts"
           echo "CRAFT_PDF_TEST_FONT_DIR=$RUNNER_TEMP/craft-pdf-test-fonts" >> "$GITHUB_ENV"
+      - name: Fetch locked Rust dependencies
+        if: steps.token.outputs.available == 'true' && hashFiles('Cargo.toml') != '' && inputs.shards <= 1
+        run: cargo fetch --locked
       - name: Generate Rust coverage
         id: coverage
         if: steps.token.outputs.available == 'true' && hashFiles('Cargo.toml') != '' && inputs.shards <= 1
diff --git a/tests/test_sonarcloud.py b/tests/test_sonarcloud.py
index 7a1c74c..a62f82c 100644
--- a/tests/test_sonarcloud.py
+++ b/tests/test_sonarcloud.py
@@ -121,6 +121,30 @@ class SonarCloudTests(unittest.TestCase):
 
     def test_coverage_is_generated_before_the_scan_imports_it(self):
         coverage = next(step for step in self.steps if step.get('id') == 'coverage')
+        fetch = next(step for step in self.steps if step.get('name') == 'Fetch locked Rust dependencies')
+        self.assertLess(self.steps.index(fetch), self.steps.index(coverage))
+        self.assertEqual(fetch['run'], 'cargo fetch --locked')
+        self.assertEqual(
+            fetch['if'],
+            "steps.token.outputs.available == 'true' && hashFiles('Cargo.toml') != '' && inputs.shards <= 1",
+        )
+        with tempfile.TemporaryDirectory() as temp:
+            root = Path(temp)
+            bin_dir = root / 'bin'
+            bin_dir.mkdir()
+            cargo = bin_dir / 'cargo'
+            cargo.write_text('#!/usr/bin/env bash\nprintf "%s\\n" "$*" > "$CARGO_CALLS"\n')
+            cargo.chmod(0o755)
+            calls = root / 'calls'
+            result = subprocess.run(
+                ['bash', '--noprofile', '--norc', '-e', '-o', 'pipefail', '-c', fetch['run']],
+                cwd=root,
+                env={**os.environ, 'PATH': f'{bin_dir}:{os.environ["PATH"]}', 'CARGO_CALLS': str(calls)},
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(calls.read_text(), 'fetch --locked\n')
         self.assertLess(self.steps.index(coverage), self.steps.index(self.scan))
         self.assertIn('cargo llvm-cov', coverage['run'])
         self.assertIn('--output-path lcov.info', coverage['run'])