diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04776b1..de50197 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,10 @@ jobs:
 
       # MSRV: cargo-checks inside the plain rust:<declared rust-version> image. With
       # rust-version: msrv the image above already is the MSRV, so the leg is redundant.
+      # The leg checks the committed Cargo.lock, as the main gate does; a crate
+      # without one resolves afresh.
       - uses: gronke/rust-ci/.github/actions/msrv@v1
         if: ${{ inputs.msrv && inputs.rust-version != 'msrv' }}
         with:
           working-directory: ${{ inputs.working-directory }}
+          locked: ${{ hashFiles(format('{0}/Cargo.lock', inputs.working-directory)) != '' }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e460dd..e7a6508 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com); releases are
 
 ### Changed
 
+- `ci.yml`: the msrv leg checks the committed `Cargo.lock` like the main gate, and resolves afresh only for a crate without one.
 - `sccache`: `auto` activates on a backend configured by the rules of the pinned release, a configuration file's cache and a multi-level chain included; a tuning variable alone (`SCCACHE_CACHE_SIZE`, a `SCCACHE_CONF` without a cache) no longer does.
 - `cargo-install`: host mode puts `<cargo-cache>/bin` on `PATH` for later steps, and `cargo-cache` may be absolute there too.
 - `sccache` downloads its release through `_lib/install-release.sh`, the installer `cargo-install` uses for prebuilt releases.
diff --git a/README.md b/README.md
index b3811e0..8a7653c 100644
--- a/README.md
+++ b/README.md
@@ -66,7 +66,7 @@ jobs:
 | `rust-version` | `latest` | `rust:<tag>` base for the image, or `msrv`. |
 | `targets` | `""` | Space-separated rustup targets to cross-check. |
 | `features` | `""` | Feature flag for the sealed lint-and-test leg. |
-| `msrv` | `true` | Also verify the crate on its declared MSRV; skipped when `rust-version` is `msrv`. |
+| `msrv` | `true` | Also verify the crate on its declared MSRV, against the committed `Cargo.lock` when there is one; skipped when `rust-version` is `msrv`. |
 | `working-directory` | `.` | Crate directory. |
 | `runs-on` | `ubuntu-latest` | The runner of the sealed job; a caller on self-hosted runners passes its label. |