diff --git a/.gitignore b/.gitignore
index ab744a1..ffe69c5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,7 @@
 # Rust
 target/
 **/target/
-Cargo.lock
+# Cargo.lock IS committed (reproducible builds; CI uses --locked).
 
 # build artifacts (firmware/kernel objects are rebuilt from source)
 *.o
diff --git a/sim/Cargo.lock b/sim/Cargo.lock
new file mode 100644
index 0000000..f78729f
--- /dev/null
+++ b/sim/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "warden-sim"
+version = "0.1.0"
diff --git a/tools/config-lint/Cargo.lock b/tools/config-lint/Cargo.lock
new file mode 100644
index 0000000..04392b6
--- /dev/null
+++ b/tools/config-lint/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "warden-config-lint"
+version = "0.1.0"