diff --git a/Cargo.toml b/Cargo.toml
index 53c93e2ba2..a71b9117db 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace]
-resolver = "2"
+resolver = "3"
 members = [
   "bindings/c",
   "bindings/wasm",
diff --git a/Dockerfile b/Dockerfile
index c929085f81..42c548b5b3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,15 +28,15 @@ FROM chef AS builder
 ARG BUILD_DEBUG=false
 ENV CARGO_PROFILE_RELEASE_DEBUG=$BUILD_DEBUG
 COPY --from=planner /recipe.json recipe.json
-RUN cargo chef cook --release --recipe-path recipe.json
+RUN cargo chef cook --release --locked --recipe-path recipe.json
 COPY . .
 ARG ENABLE_FEATURES=""
 RUN if [ "$ENABLE_FEATURES" == "" ]; then \
-        cargo build -p libsql-server --release ; \
+        cargo build -p libsql-server --release --locked ; \
     else \
-        cargo build -p libsql-server --features "$ENABLE_FEATURES" --release ; \
+        cargo build -p libsql-server --features "$ENABLE_FEATURES" --release --locked ; \
     fi
-RUN cargo build -p bottomless-cli --release
+RUN cargo build -p bottomless-cli --release --locked
 
 # official gosu install instruction (https://github.com/tianon/gosu/blob/master/INSTALL.md)
 FROM debian:bullseye-slim as gosu
diff --git a/libsql-sqlite3/ext/crr/rs/bundle/Cargo.toml b/libsql-sqlite3/ext/crr/rs/bundle/Cargo.toml
index a5bcc151ab..706c158570 100644
--- a/libsql-sqlite3/ext/crr/rs/bundle/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/bundle/Cargo.toml
@@ -41,3 +41,5 @@ omit_load_extension = [
   "crsql_fractindex_core/omit_load_extension",
   "crsql_core/omit_load_extension"
 ]
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/bundle_static/Cargo.toml b/libsql-sqlite3/ext/crr/rs/bundle_static/Cargo.toml
index 2e07f5136a..d70813b7d2 100644
--- a/libsql-sqlite3/ext/crr/rs/bundle_static/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/bundle_static/Cargo.toml
@@ -33,3 +33,5 @@ static = [
 omit_load_extension = [
   "crsql_bundle/omit_load_extension"
 ]
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/core/Cargo.toml b/libsql-sqlite3/ext/crr/rs/core/Cargo.toml
index c6464f5aa4..2b7ba86556 100644
--- a/libsql-sqlite3/ext/crr/rs/core/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/core/Cargo.toml
@@ -30,3 +30,5 @@ libsql = []
 loadable_extension = ["sqlite_nostd/loadable_extension"]
 static = ["sqlite_nostd/static"]
 omit_load_extension = ["sqlite_nostd/omit_load_extension"]
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/fractindex-core/Cargo.toml b/libsql-sqlite3/ext/crr/rs/fractindex-core/Cargo.toml
index 0aabb02f84..b629340c78 100644
--- a/libsql-sqlite3/ext/crr/rs/fractindex-core/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/fractindex-core/Cargo.toml
@@ -29,3 +29,5 @@ target = "wasm32-unknown-emscripten"
 loadable_extension = ["sqlite_nostd/loadable_extension"]
 static = ["sqlite_nostd/static"]
 omit_load_extension = ["sqlite_nostd/omit_load_extension"]
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/integration_check/Cargo.toml b/libsql-sqlite3/ext/crr/rs/integration_check/Cargo.toml
index c40c89a9c7..c9a07d92b6 100644
--- a/libsql-sqlite3/ext/crr/rs/integration_check/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/integration_check/Cargo.toml
@@ -24,3 +24,5 @@ cc = "1.0"
 libsql = ["crsql_bundle/libsql"]
 static = []
 omit_load_extension = []
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_allocator/Cargo.toml b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_allocator/Cargo.toml
index f6ea3dcfe9..81db82d124 100644
--- a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_allocator/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_allocator/Cargo.toml
@@ -16,3 +16,5 @@ sqlite3_capi = {version="0.1.0", path="../sqlite3_capi"}
 
 # dev dependencies for examples
 [dev-dependencies]
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_capi/Cargo.toml b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_capi/Cargo.toml
index d75ae3f08b..519a6a928f 100644
--- a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_capi/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite3_capi/Cargo.toml
@@ -16,3 +16,5 @@ bindgen = "0.68.1"
 loadable_extension = []
 static = []
 omit_load_extension = []
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_nostd/Cargo.toml b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_nostd/Cargo.toml
index 78a3529846..a0f3da9346 100644
--- a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_nostd/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_nostd/Cargo.toml
@@ -17,3 +17,5 @@ num-derive = "0.4.1"
 loadable_extension = ["sqlite3_capi/loadable_extension"]
 static = ["sqlite3_capi/static"]
 omit_load_extension = ["sqlite3_capi/omit_load_extension"]
+
+[workspace]
diff --git a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_web/Cargo.toml b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_web/Cargo.toml
index 78097eaa9f..22755af61b 100644
--- a/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_web/Cargo.toml
+++ b/libsql-sqlite3/ext/crr/rs/sqlite-rs-embedded/sqlite_web/Cargo.toml
@@ -14,3 +14,5 @@ sqlite_nostd = { path="../sqlite_nostd"}
 loadable_extension = ["sqlite_nostd/loadable_extension"]
 static = ["sqlite_nostd/static"]
 
+
+[workspace]
diff --git a/libsql-sqlite3/test/rust_suite/Cargo.toml b/libsql-sqlite3/test/rust_suite/Cargo.toml
index 23c1735abe..30a6aecbf0 100644
--- a/libsql-sqlite3/test/rust_suite/Cargo.toml
+++ b/libsql-sqlite3/test/rust_suite/Cargo.toml
@@ -3,7 +3,13 @@ name = "libsql_rust_suite"
 version = "0.2.0"
 edition = "2021"
 
+# This crate is its own workspace root with no committed Cargo.lock, so CI
+# resolves it from scratch every run. resolver = "3" makes that resolution
+# MSRV-aware (it honors the 1.85.0 toolchain in rust-toolchain.toml) so it does
+# not pull in deps that require a newer compiler (e.g. icu_*/idna_adapter @ 1.86,
+# wasip2/wit-bindgen @ 1.87).
 [workspace]
+resolver = "3"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html