diff --git a/infra/recipes/health_check.py b/infra/recipes/health_check.py
index d6f327934f..12f864ea27 100644
--- a/infra/recipes/health_check.py
+++ b/infra/recipes/health_check.py
@@ -42,7 +42,6 @@ def RunSteps(api):
                 "Checking %s" % check, ["./tools/health-check", "--all", check]
             )
 
-        # TODO: Move these into health-check
         api.crosvm.step_in_container("Checking mdbook", ["mdbook", "build", "docs/book/"])
         api.crosvm.step_in_container(
             "Checking cargo docs",
diff --git a/tools/clippy b/tools/clippy
index 6c151355b0..b6a84c84b7 100755
--- a/tools/clippy
+++ b/tools/clippy
@@ -31,13 +31,14 @@ def is_crate_excluded(crate: str) -> bool:
     return crate in excluded_crates
 
 
-def main(fix: bool = False, json: bool = False):
+def main(fix: bool = False, json: bool = False, locked: bool = False):
     chdir(CROSVM_ROOT)
 
     # Note: Clippy checks are configured in .cargo/config.toml
     common_args = [
         "--fix" if fix else None,
         "--message-format=json" if json else None,
+        "--locked" if locked else None,
         "--all-targets",
         "--",
         "-Dwarnings",
diff --git a/tools/health-check b/tools/health-check
index 0316a34656..a2dbfdf19e 100755
--- a/tools/health-check
+++ b/tools/health-check
@@ -3,16 +3,10 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+from pathlib import Path
 from typing import List
 import sys
-from impl.common import (
-    CROSVM_ROOT,
-    parallel,
-    run_main,
-    cmd,
-    chdir,
-    argh,
-)
+from impl.common import CROSVM_ROOT, parallel, run_main, cmd, chdir, argh, cwd_context
 from impl.check_code_hygiene import has_crlf_line_endings
 from impl.health_check import Check, CheckContext, run_checks
 
@@ -50,7 +44,7 @@ def check_markdown_format(context: CheckContext):
 
 def check_rust_clippy(_: CheckContext):
     "Runs clippy on the whole project, no matter which rs files were touched."
-    cmd("./tools/clippy").fg()
+    cmd("./tools/clippy --locked").fg()
 
 
 def check_rust_format(context: CheckContext):
@@ -67,12 +61,29 @@ def check_rust_format(context: CheckContext):
     )
 
 
+def check_rust_lockfiles(_: CheckContext):
+    "Verifies that none of the Cargo.lock files require updates."
+    lockfiles = [Path("Cargo.lock"), *Path("common").glob("*/Cargo.lock")]
+    for path in lockfiles:
+        with cwd_context(path.parent):
+            if not cmd("cargo update --workspace --locked").success():
+                print(f"{path} is not up-to-date.")
+                print()
+                print("You may need to rebase your changes and run `cargo update --workspace`")
+                print("(or ./tools/run_tests) to ensure the Cargo.lock file is current.")
+                raise Exception("Cargo.lock out of date")
+
+
 # List of all checks and on which files they should run.
 CHECKS: List[Check] = [
     Check(
         check_rust_format,
         files=["**.rs"],
     ),
+    Check(
+        check_rust_lockfiles,
+        files=["**Cargo.toml"],
+    ),
     Check(
         check_rust_clippy,
         files=["**.rs", "**Cargo.toml"],