diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 82790d4..bc2792a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -56,9 +56,13 @@ jobs:
             _build
           key: ${{ runner.os }}-mix-otp${{ matrix.otp }}-elixir${{ matrix.elixir }}-${{ hashFiles('**/mix.lock') }}
 
-      - name: Install and compile dependencies
+      - name: Fetch dependencies and verify mix.lock
         if: steps.cache-deps.outputs.cache-hit != 'true'
-        run: mix do deps.get --only test, deps.compile
+        run: mix deps.get --check-locked
+
+      - name: Compile dependencies
+        if: steps.cache-deps.outputs.cache-hit != 'true'
+        run: mix deps.compile
 
       # Don't cache PLTs based on mix.lock hash, as Dialyzer can incrementally update even old ones
       # Cache key based on Elixir & Erlang version (also useful when running in matrix)