diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b717026d..27352f92b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@ All notable changes to this project will be documented in this file.
 
 - opensearch-dashboards: Bump cdxgen to 13.0.1 and pin the CycloneDX spec version to 1.6 ([#1600]).
 - opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1639]).
+- vector: Build with `--locked` ([#1674]).
 
 ### Fixed
 
@@ -90,6 +91,7 @@ All notable changes to this project will be documented in this file.
 [#1662]: https://github.com/stackabletech/docker-images/pull/1662
 [#1664]: https://github.com/stackabletech/docker-images/pull/1664
 [#1670]: https://github.com/stackabletech/docker-images/pull/1670
+[#1674]: https://github.com/stackabletech/docker-images/pull/1674
 
 ## [26.7.0] - 2026-07-21
 
diff --git a/vector/Dockerfile b/vector/Dockerfile
index 24757d33d..0baa2e2fe 100644
--- a/vector/Dockerfile
+++ b/vector/Dockerfile
@@ -86,7 +86,10 @@ tar -czf /stackable/vector-${NEW_VERSION}-src.tar.gz .
 # to be usable for both the build and the SBOM generation below.
 VECTOR_FEATURES="sources-file,sources-internal_logs,transforms-remap,transforms-filter,transforms-route,sinks-vector,sinks-opentelemetry,sinks-console,sinks-blackhole,api,unix"
 
-cargo auditable --quiet build --release --no-default-features --features "${VECTOR_FEATURES}"
+# --locked makes the build fail instead of silently updating Cargo.lock. Without it a
+# dependency could resolve to a newer version than the one upstream locked, which would
+# make the build non-reproducible and bypass the checksums recorded in Cargo.lock.
+cargo auditable --quiet build --locked --release --no-default-features --features "${VECTOR_FEATURES}"
 
 # Generate SBOMs and copy them to /app (via a script)
 # The feature flags must be the same as for the build above. Without them cargo-cyclonedx