diff --git a/.github/workflows/test-tidy.yml b/.github/workflows/test-tidy.yml
index eb0fa204d..a725abf26 100644
--- a/.github/workflows/test-tidy.yml
+++ b/.github/workflows/test-tidy.yml
@@ -51,7 +51,9 @@ jobs:
 
       - name: Run Bazel tidy
         shell: bash
-        run: bazel run //:tidy
+        run: |
+          bazel run //:tidy
+          bazel mod deps --lockfile_mode=update
 
       - name: Check if untidy
         id: untidy
diff --git a/dev-docs/workflows/bazel.md b/dev-docs/workflows/bazel.md
index 2e8ee57ea..8dc38b7ea 100644
--- a/dev-docs/workflows/bazel.md
+++ b/dev-docs/workflows/bazel.md
@@ -3,6 +3,13 @@
 Bazel is the primary build system for this project. It is used to build all Go code and will be used to build all artifacts in the future.
 Still, we aim to keep the codebase compatible with `go build` and `go test` as well.
 Whenever Go code is changed, you will have to run `bazel run //:tidy` to regenerate the Bazel build files for Go code.
+Additionally, you need to update `MODULE.bazel`, together with `MODULE.bazel.lock`:
+
+```
+# if the steps below fail, try to recreate the lockfile from scratch by deleting it
+bazel mod deps --lockfile_mode=update
+bazel mod tidy
+```
 
 ## Bazel commands