diff --git a/.github/workflows/clippy.yml b/.github/workflows/clippy.yml
index acf3d2d097a..92e385d135c 100644
--- a/.github/workflows/clippy.yml
+++ b/.github/workflows/clippy.yml
@@ -17,9 +17,8 @@ jobs:
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > rustup-init.sh
           sh rustup-init.sh -y --default-toolchain none
-          rustup target add x86_64-unknown-linux-gnu
       - name: Check clippy configs all match
-        run: cargo run --manifest-path ci/Cargo.toml -- clippy-config-check
+        run: cargo run --locked --manifest-path ci/Cargo.toml -- clippy-config-check
 
 
   run_clippy:
@@ -41,5 +40,5 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > rustup-init.sh
           sh rustup-init.sh -y --default-toolchain none
       - name: clippy
-        run: cargo clippy --manifest-path ${{ matrix.package }}/Cargo.toml
+        run: cargo clippy --locked --manifest-path ${{ matrix.package }}/Cargo.toml
 
diff --git a/check_diff/Cargo.toml b/check_diff/Cargo.toml
index 18a4aa90d6c..b18aa0c39d0 100644
--- a/check_diff/Cargo.toml
+++ b/check_diff/Cargo.toml
@@ -15,3 +15,17 @@ diffy = "0.4.0"
 crossbeam-channel = "0.5.15"
 ignore = "0.4.25"
 toml = "1.1"
+
+[lints.clippy]
+# allow all rules with a low priority ..
+all = { level = "allow", priority = -1 }
+# so we can pick out an exact subset of rules to deny
+correctness = "deny"
+char_lit_as_u8 = "deny"
+four_forward_slashes = "deny"
+non_minimal_cfg = "deny"
+print_literal = "deny"
+same_item_push = "deny"
+single_char_add_str = "deny"
+to_string_in_format_args = "deny"
+unconditional_recursion = "deny"
diff --git a/ci/src/clippy_config_check.rs b/ci/src/clippy_config_check.rs
index 011ffe4ef18..c4c59f692f6 100644
--- a/ci/src/clippy_config_check.rs
+++ b/ci/src/clippy_config_check.rs
@@ -4,6 +4,7 @@ use itertools::Itertools;
 
 const CARGO_TOMLS: &[&'static str] = &[
     "Cargo.toml",
+    "check_diff/Cargo.toml",
     "ci/Cargo.toml",
     "config_proc_macro/Cargo.toml",
 ];