WORKSPACE: fix usage of bzlmod lockfile

Closes monogon-dev/monogon#311

Change-Id: Ib93802389e3f11f6f03f1fe5278b32c270e37cd4
Reviewed-on: https://review.monogon.dev/c/monogon/+/3250
Tested-by: Jenkins CI
Reviewed-by: Leopold Schabel <leo@monogon.tech>
diff --git a/.bazelrc b/.bazelrc
index 246c7ce..77d25d8 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -4,6 +4,10 @@
 import %workspace%/third_party/bazelrc/aspect/correctness.bazelrc
 import %workspace%/third_party/bazelrc/aspect/performance.bazelrc
 
+# Actually make the lock file a lock file by not updating it without any
+# request to do so.
+common --lockfile_mode=error
+
 # Allow empty globs as there are a lot until we replace our rust toolchain and
 # qemu BUILD files.
 common --noincompatible_disallow_empty_glob