diff --git a/src/bin/upgrade/main.rs b/src/bin/upgrade/main.rs
index d4126b174d..52c70f8011 100644
--- a/src/bin/upgrade/main.rs
+++ b/src/bin/upgrade/main.rs
@@ -55,7 +55,12 @@ Dev, build, and all target dependencies will also be upgraded. Only dependencies
 supported. Git/path dependencies will be ignored.
 
 All packages in the workspace will be upgraded if the `--all` flag is supplied. The `--all` flag may
-be supplied in the presence of a virtual manifest."
+be supplied in the presence of a virtual manifest.
+
+If the '--to-lockfile' flag is supplied, all dependencies will be upgraded to the currently locked
+version as recorded in the Cargo.lock file. This flag requires that the Cargo.lock file is
+up-to-date. If the lock file is missing, or it needs to be updated, cargo-upgrade will exit with an
+error. If the '--to-lockfile' flag is supplied then the network won't be accessed."
     )]
     Upgrade(Args),
 }
@@ -84,11 +89,42 @@ struct Args {
     /// Run without accessing the network
     #[structopt(long = "offline")]
     pub offline: bool,
+
+    /// Upgrade all packages to the version in the lockfile.
+    #[structopt(long = "to-lockfile", conflicts_with = "dependency")]
+    pub to_lockfile: bool,
 }
 
 /// A collection of manifests.
 struct Manifests(Vec<(LocalManifest, cargo_metadata::Package)>);
 
+/// Helper function to check whether a `cargo_metadata::Dependency` is a version dependency.
+fn is_version_dep(dependency: &cargo_metadata::Dependency) -> bool {
+    match dependency.source {
+        // This is the criterion cargo uses (in `SourceId::from_url`) to decide whether a
+        // dependency has the 'registry' kind.
+        Some(ref s) => s.splitn(2, '+').next() == Some("registry"),
+        _ => false,
+    }
+}
+
+fn dry_run_message() -> Result<()> {
+    let bufwtr = BufferWriter::stdout(ColorChoice::Always);
+    let mut buffer = bufwtr.buffer();
+    buffer
+        .set_color(ColorSpec::new().set_fg(Some(Color::Cyan)).set_bold(true))
+        .chain_err(|| "Failed to set output colour")?;
+    write!(&mut buffer, "Starting dry run. ").chain_err(|| "Failed to write dry run message")?;
+    buffer
+        .set_color(&ColorSpec::new())
+        .chain_err(|| "Failed to clear output colour")?;
+    writeln!(&mut buffer, "Changes will not be saved.")
+        .chain_err(|| "Failed to write dry run message")?;
+    bufwtr
+        .print(&buffer)
+        .chain_err(|| "Failed to print dry run message")
+}
+
 impl Manifests {
     /// Get all manifests in the workspace.
     fn get_all(manifest_path: &Option<PathBuf>) -> Result<Self> {
@@ -145,16 +181,6 @@ impl Manifests {
     /// Get the the combined set of dependencies to upgrade. If the user has specified
     /// per-dependency desired versions, extract those here.
     fn get_dependencies(&self, only_update: Vec<String>) -> Result<DesiredUpgrades> {
-        /// Helper function to check whether a `cargo_metadata::Dependency` is a version dependency.
-        fn is_version_dep(dependency: &cargo_metadata::Dependency) -> bool {
-            match dependency.source {
-                // This is the criterion cargo uses (in `SourceId::from_url`) to decide whether a
-                // dependency has the 'registry' kind.
-                Some(ref s) => s.splitn(2, '+').next() == Some("registry"),
-                _ => false,
-            }
-        }
-
         // Map the names of user-specified dependencies to the (optionally) requested version.
         let selected_dependencies = only_update
             .into_iter()
@@ -203,21 +229,7 @@ impl Manifests {
     /// Upgrade the manifests on disk following the previously-determined upgrade schema.
     fn upgrade(self, upgraded_deps: &ActualUpgrades, dry_run: bool) -> Result<()> {
         if dry_run {
-            let bufwtr = BufferWriter::stdout(ColorChoice::Always);
-            let mut buffer = bufwtr.buffer();
-            buffer
-                .set_color(ColorSpec::new().set_fg(Some(Color::Cyan)).set_bold(true))
-                .chain_err(|| "Failed to set output colour")?;
-            write!(&mut buffer, "Starting dry run. ")
-                .chain_err(|| "Failed to write dry run message")?;
-            buffer
-                .set_color(&ColorSpec::new())
-                .chain_err(|| "Failed to clear output colour")?;
-            writeln!(&mut buffer, "Changes will not be saved.")
-                .chain_err(|| "Failed to write dry run message")?;
-            bufwtr
-                .print(&buffer)
-                .chain_err(|| "Failed to print dry run message")?;
+            dry_run_message()?;
         }
 
         for (mut manifest, package) in self.0 {
@@ -234,6 +246,61 @@ impl Manifests {
 
         Ok(())
     }
+
+    /// Update dependencies in Cargo.toml file(s) to match the corresponding
+    /// version in Cargo.lock.
+    fn sync_to_lockfile(self, dry_run: bool) -> Result<()> {
+        // Get locked dependencies. For workspaces with multiple Cargo.toml
+        // files, there is only a single lockfile, so it suffices to get
+        // metadata for any one of Cargo.toml files.
+        let (manifest, _package) =
+            self.0.iter().next().ok_or_else(|| {
+                ErrorKind::CargoEditLib(::cargo_edit::ErrorKind::InvalidCargoConfig)
+            })?;
+        let mut cmd = cargo_metadata::MetadataCommand::new();
+        cmd.manifest_path(manifest.path.clone());
+        cmd.other_options(vec!["--locked".to_string()]);
+
+        let result = cmd
+            .exec()
+            .map_err(|e| Error::from(e.compat()).chain_err(|| "Invalid manifest"))?;
+
+        let locked = result
+            .packages
+            .into_iter()
+            .filter(|p| p.source.is_some()) // Source is none for local packages
+            .collect::<Vec<_>>();
+
+        if dry_run {
+            dry_run_message()?;
+        }
+
+        for (mut manifest, package) in self.0 {
+            println!("{}:", package.name);
+
+            // Upgrade the manifests one at a time, as multiple manifests may
+            // request the same dependency at differing versions.
+            for (name, version) in package
+                .dependencies
+                .clone()
+                .into_iter()
+                .filter(is_version_dep)
+                .filter_map(|d| {
+                    for p in &locked {
+                        // The requested dependency may be present in the lock file with different versions,
+                        // but only one will be semver-compatible with the requested version.
+                        if d.name == p.name && d.req.matches(&p.version) {
+                            return Some((d.name, p.version.to_string()));
+                        }
+                    }
+                    None
+                })
+            {
+                manifest.upgrade(&Dependency::new(&name).set_version(&version), dry_run)?;
+            }
+        }
+        Ok(())
+    }
 }
 
 /// The set of dependencies to be upgraded, alongside the registries returned from cargo metadata, and
@@ -287,10 +354,11 @@ fn process(args: Args) -> Result<()> {
         all,
         allow_prerelease,
         dry_run,
+        to_lockfile,
         ..
     } = args;
 
-    if !args.offline {
+    if !args.offline && !to_lockfile {
         let url = registry_url(&find(&manifest_path)?, None)?;
         update_registry_index(&url)?;
     }
@@ -301,27 +369,31 @@ fn process(args: Args) -> Result<()> {
         Manifests::get_local_one(&manifest_path)
     }?;
 
-    let existing_dependencies = manifests.get_dependencies(dependency)?;
-
-    // Update indices for any alternative registries, unless
-    // we're offline.
-    if !args.offline {
-        for registry_url in existing_dependencies
-            .0
-            .values()
-            .filter_map(|(registry, _)| registry.as_ref())
-            .collect::<HashSet<_>>()
-        {
-            update_registry_index(&Url::parse(registry_url).map_err(|_| {
-                ErrorKind::CargoEditLib(::cargo_edit::ErrorKind::InvalidCargoConfig)
-            })?)?;
+    if to_lockfile {
+        manifests.sync_to_lockfile(dry_run)
+    } else {
+        let existing_dependencies = manifests.get_dependencies(dependency)?;
+
+        // Update indices for any alternative registries, unless
+        // we're offline.
+        if !args.offline {
+            for registry_url in existing_dependencies
+                .0
+                .values()
+                .filter_map(|(registry, _)| registry.as_ref())
+                .collect::<HashSet<_>>()
+            {
+                update_registry_index(&Url::parse(registry_url).map_err(|_| {
+                    ErrorKind::CargoEditLib(::cargo_edit::ErrorKind::InvalidCargoConfig)
+                })?)?;
+            }
         }
-    }
 
-    let upgraded_dependencies =
-        existing_dependencies.get_upgraded(allow_prerelease, &find(&manifest_path)?)?;
+        let upgraded_dependencies =
+            existing_dependencies.get_upgraded(allow_prerelease, &find(&manifest_path)?)?;
 
-    manifests.upgrade(&upgraded_dependencies, dry_run)
+        manifests.upgrade(&upgraded_dependencies, dry_run)
+    }
 }
 
 fn main() {
diff --git a/src/manifest.rs b/src/manifest.rs
index 41bfc34a98..832c601491 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -366,7 +366,7 @@ impl str::FromStr for Manifest {
 #[derive(Debug)]
 pub struct LocalManifest {
     /// Path to the manifest
-    path: PathBuf,
+    pub path: PathBuf,
     /// Manifest contents
     manifest: Manifest,
 }
diff --git a/tests/cargo-upgrade.rs b/tests/cargo-upgrade.rs
index e11cc41c74..106ccd689c 100644
--- a/tests/cargo-upgrade.rs
+++ b/tests/cargo-upgrade.rs
@@ -1,7 +1,7 @@
 #[macro_use]
 extern crate pretty_assertions;
 
-use std::fs;
+use std::{fs, path::Path};
 
 mod utils;
 use crate::utils::{
@@ -41,6 +41,7 @@ pub fn copy_workspace_test() -> (tempdir::TempDir, String, Vec<String>) {
 
         let root_manifest_path = copy_in(".", "Cargo.toml");
         copy_in(".", "dummy.rs");
+        copy_in(".", "Cargo.lock");
 
         let workspace_manifest_paths = ["one", "two", "implicit/three", "explicit/four"]
             .iter()
@@ -415,6 +416,40 @@ For more information try --help ",
     .unwrap();
 }
 
+// Verify that an upgraded Cargo.toml matches what we expect.
+#[test]
+fn upgrade_to_lockfile() {
+    let (tmpdir, manifest) = clone_out_test("tests/fixtures/upgrade/Cargo.toml.lockfile_source");
+    fs::copy(
+        Path::new("tests/fixtures/upgrade/Cargo.lock"),
+        tmpdir.path().join("Cargo.lock"),
+    )
+    .unwrap_or_else(|err| panic!("could not copy test lock file: {}", err));;
+    execute_command(&["upgrade", "--to-lockfile"], &manifest);
+
+    let upgraded = get_toml(&manifest);
+    let target = get_toml("tests/fixtures/upgrade/Cargo.toml.lockfile_target");
+
+    assert_eq!(target.to_string(), upgraded.to_string());
+}
+
+#[test]
+fn upgrade_workspace_to_lockfile() {
+    let (tmpdir, root_manifest, _workspace_manifests) = copy_workspace_test();
+
+    execute_command(&["upgrade", "--all", "--to-lockfile"], &root_manifest);
+
+    // The members one and two both request different, semver incompatible
+    // versions of rand. Test that both were upgraded correctly.
+    let one_upgraded = get_toml(tmpdir.path().join("one/Cargo.toml").to_str().unwrap());
+    let one_target = get_toml("tests/fixtures/workspace/one/Cargo.toml.lockfile_target");
+    assert_eq!(one_target.to_string(), one_upgraded.to_string());
+
+    let two_upgraded = get_toml(tmpdir.path().join("two/Cargo.toml").to_str().unwrap());
+    let two_target = get_toml("tests/fixtures/workspace/two/Cargo.toml.lockfile_target");
+    assert_eq!(two_target.to_string(), two_upgraded.to_string());
+}
+
 #[test]
 #[cfg(feature = "test-external-apis")]
 fn upgrade_prints_messages() {
diff --git a/tests/fixtures/upgrade/Cargo.lock b/tests/fixtures/upgrade/Cargo.lock
new file mode 100644
index 0000000000..c552749174
--- /dev/null
+++ b/tests/fixtures/upgrade/Cargo.lock
@@ -0,0 +1,78 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "advapi32-sys"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+ "winapi-build 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "libc"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "libc"
+version = "0.2.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "one"
+version = "0.1.0"
+dependencies = [
+ "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.3.10 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "advapi32-sys 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)",
+ "libc 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)",
+ "winapi 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "winapi"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "winapi"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "winapi-i686-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "winapi-build"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[metadata]
+"checksum advapi32-sys 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)" = "307c92332867e586720c0222ee9d890bbe8431711efed8a1b06bc5b40fc66bd7"
+"checksum libc 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)" = "e32a70cf75e5846d53a673923498228bbec6a8624708a9ea5645f075d6276122"
+"checksum libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)" = "1a31a0627fdf1f6a39ec0dd577e101440b7db22672c0901fe00a9a6fbb5c24e8"
+"checksum rand 0.3.10 (registry+https://github.com/rust-lang/crates.io-index)" = "ea766199c2c97314b1c1aa5c5084d0e85558e4bfadfbe657ee8cd61fecf7cda0"
+"checksum winapi 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)" = "167dc9d6949a9b857f3451275e911c3f44255842c1f7a76f33c55103a909087a"
+"checksum winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)" = "8093091eeb260906a183e6ae1abdba2ef5ef2257a21801128899c3fc699229c6"
+"checksum winapi-build 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "2d315eee3b34aca4797b2da6b13ed88266e6d612562a0c46390af8299fc699bc"
+"checksum winapi-i686-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+"checksum winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/tests/fixtures/upgrade/Cargo.toml.lockfile_source b/tests/fixtures/upgrade/Cargo.toml.lockfile_source
new file mode 100644
index 0000000000..b827c58fd4
--- /dev/null
+++ b/tests/fixtures/upgrade/Cargo.toml.lockfile_source
@@ -0,0 +1,10 @@
+[package]
+name = "one"
+version = "0.1.0"
+
+[lib]
+path = "../dummy.rs"
+
+[dependencies]
+libc = "0.2.28"
+rand = "0.3"
diff --git a/tests/fixtures/upgrade/Cargo.toml.lockfile_target b/tests/fixtures/upgrade/Cargo.toml.lockfile_target
new file mode 100644
index 0000000000..6326812791
--- /dev/null
+++ b/tests/fixtures/upgrade/Cargo.toml.lockfile_target
@@ -0,0 +1,10 @@
+[package]
+name = "one"
+version = "0.1.0"
+
+[lib]
+path = "../dummy.rs"
+
+[dependencies]
+libc = "0.2.65"
+rand = "0.3.10"
diff --git a/tests/fixtures/workspace/Cargo.lock b/tests/fixtures/workspace/Cargo.lock
new file mode 100644
index 0000000000..59bda66005
--- /dev/null
+++ b/tests/fixtures/workspace/Cargo.lock
@@ -0,0 +1,137 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "four"
+version = "0.1.0"
+dependencies = [
+ "libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "libc"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "libc"
+version = "0.2.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "log"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "one"
+version = "0.1.0"
+dependencies = [
+ "libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.3.23 (registry+https://github.com/rust-lang/crates.io-index)",
+ "three 0.1.0",
+]
+
+[[package]]
+name = "rand"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "libc 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)",
+ "log 0.2.5 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "three"
+version = "0.1.0"
+dependencies = [
+ "libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "two"
+version = "0.1.0"
+dependencies = [
+ "libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "winapi-i686-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[metadata]
+"checksum fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+"checksum libc 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)" = "e32a70cf75e5846d53a673923498228bbec6a8624708a9ea5645f075d6276122"
+"checksum libc 0.2.62 (registry+https://github.com/rust-lang/crates.io-index)" = "34fcd2c08d2f832f376f4173a231990fa5aef4e99fb569867318a227ef4c06ba"
+"checksum log 0.2.5 (registry+https://github.com/rust-lang/crates.io-index)" = "f91d813fb009895c01b1b5c095fc88aea17138355bc0e4d53a277c466f62161f"
+"checksum rand 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "28cb601e872bcf1e2667d0433d2b5f2c53d37a6ca05e948fd1a977fa087e42e3"
+"checksum rand 0.3.23 (registry+https://github.com/rust-lang/crates.io-index)" = "64ac302d8f83c0c1974bf758f6b041c6c8ada916fbb44a609158ca8b064cc76c"
+"checksum rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)" = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+"checksum rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)" = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+"checksum rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)" = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+"checksum rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+"checksum winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)" = "8093091eeb260906a183e6ae1abdba2ef5ef2257a21801128899c3fc699229c6"
+"checksum winapi-i686-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+"checksum winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/tests/fixtures/workspace/Cargo.toml.lockfile_target b/tests/fixtures/workspace/Cargo.toml.lockfile_target
new file mode 100644
index 0000000000..165bb54e20
--- /dev/null
+++ b/tests/fixtures/workspace/Cargo.toml.lockfile_target
@@ -0,0 +1,6 @@
+[workspace]
+members = [
+    "one",
+    "two",
+    "explicit/*"
+]
\ No newline at end of file
diff --git a/tests/fixtures/workspace/one/Cargo.toml b/tests/fixtures/workspace/one/Cargo.toml
index 9db72dfcc3..1699a8fc46 100644
--- a/tests/fixtures/workspace/one/Cargo.toml
+++ b/tests/fixtures/workspace/one/Cargo.toml
@@ -7,4 +7,5 @@ path = "../dummy.rs"
 
 [dependencies]
 libc = "0.2.28"
-three = { path = "../implicit/three"}
+rand = "0.3"
+three = { path = "../implicit/three"}
\ No newline at end of file
diff --git a/tests/fixtures/workspace/one/Cargo.toml.lockfile_target b/tests/fixtures/workspace/one/Cargo.toml.lockfile_target
new file mode 100644
index 0000000000..e7a14fa84a
--- /dev/null
+++ b/tests/fixtures/workspace/one/Cargo.toml.lockfile_target
@@ -0,0 +1,11 @@
+[package]
+name = "one"
+version = "0.1.0"
+
+[lib]
+path = "../dummy.rs"
+
+[dependencies]
+libc = "0.2.62"
+rand = "0.3.23"
+three = { path = "../implicit/three"}
diff --git a/tests/fixtures/workspace/two/Cargo.toml b/tests/fixtures/workspace/two/Cargo.toml
index 9c90772893..797b3b9567 100644
--- a/tests/fixtures/workspace/two/Cargo.toml
+++ b/tests/fixtures/workspace/two/Cargo.toml
@@ -7,4 +7,5 @@ name = "two"
 path = "../dummy.rs"
 
 [dependencies]
-libc = "0.2.28"
\ No newline at end of file
+libc = "0.2.28"
+rand = "0.2"
\ No newline at end of file
diff --git a/tests/fixtures/workspace/two/Cargo.toml.lockfile_target b/tests/fixtures/workspace/two/Cargo.toml.lockfile_target
new file mode 100644
index 0000000000..4796aac707
--- /dev/null
+++ b/tests/fixtures/workspace/two/Cargo.toml.lockfile_target
@@ -0,0 +1,11 @@
+[package]
+name = "two"
+version = "0.1.0"
+
+[[bin]]
+name = "two"
+path = "../dummy.rs"
+
+[dependencies]
+libc = "0.2.62"
+rand = "0.2.1"