--locked
This should ensure that CI fails if the lockfile is not up-to-date (see: https://github.com/astral-sh/ruff/pull/9235).