diff --git a/.github/actions/fabric-tests/action.yml b/.github/actions/fabric-tests/action.yml
index aae958fc..0756607f 100644
--- a/.github/actions/fabric-tests/action.yml
+++ b/.github/actions/fabric-tests/action.yml
@@ -46,6 +46,17 @@ runs:
         echo 'disable_checkpoint = true' \
           | tee -a /home/runner/.terraformrc
         mkdir -p ${{ env.TF_PLUGIN_CACHE_DIR }}
+
+    - uses: actions/download-artifact@v3
+      with:
+        name: lockfile
+
+    - name: Cache Terraform
+      uses: actions/cache@v3
+      with:
+        path: ${{ env.TF_PLUGIN_CACHE_DIR }}
+        key: ${{ runner.os }}-terraform-${{ hashFiles('tools/lockfile/.terraform.lock.hcl') }}
+
     # avoid conflicts with user-installed providers on local machines
     - name: Pin provider versions
       shell: bash
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 02d332ae..25725cd4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -31,8 +31,37 @@ env:
   TF_VERSION: 1.4.4
 
 jobs:
+  setup-tf-providers:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
+          terraform_wrapper: false
+
+      - name: Cache Terraform
+        uses: actions/cache@v3
+        with:
+          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
+          key: ${{ runner.os }}-terraform-${{ hashFiles('tools/lockfile/.terraform.lock.hcl') }}
+
+      - shell: bash
+        run: |
+          mkdir -p ${{ env.TF_PLUGIN_CACHE_DIR }}
+          cd tools/lockfile
+          terraform init
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: lockfile
+          path: tools/lockfile/.terraform.lock.hcl
+
+
   examples-blueprints:
     runs-on: ubuntu-latest
+    needs: setup-tf-providers
     steps:
       - uses: actions/checkout@v3
 
@@ -47,6 +76,7 @@ jobs:
 
   examples-modules:
     runs-on: ubuntu-latest
+    needs: setup-tf-providers
     steps:
       - uses: actions/checkout@v3
 
@@ -61,6 +91,7 @@ jobs:
 
   blueprints:
     runs-on: ubuntu-latest
+    needs: setup-tf-providers
     steps:
       - uses: actions/checkout@v3
 
@@ -75,6 +106,7 @@ jobs:
 
   modules:
     runs-on: ubuntu-latest
+    needs: setup-tf-providers
     steps:
       - uses: actions/checkout@v3
 
@@ -89,6 +121,7 @@ jobs:
 
   fast:
     runs-on: ubuntu-latest
+    needs: setup-tf-providers
     steps:
       - uses: actions/checkout@v3
 
diff --git a/tests/fixtures.py b/tests/fixtures.py
index c142a610..98bf3a26 100644
--- a/tests/fixtures.py
+++ b/tests/fixtures.py
@@ -25,6 +25,7 @@ import pytest
 import tftest
 import yaml
 
+_REPO_ROOT = Path(__file__).parents[1]
 PlanSummary = collections.namedtuple('PlanSummary', 'values counts outputs')
 
 
@@ -51,10 +52,14 @@ def _prepare_root_module(path):
                                                '*.auto.tfvars.json',
                                                '[0-9]-*-providers.tf',
                                                'terraform.tfstate*',
+                                               '.terraform.lock.hcl',
                                                'terraform.tfvars', '.terraform')
 
       shutil.copytree(path, tmp_path, dirs_exist_ok=True,
                       ignore=ignore_patterns)
+      lockfile = _REPO_ROOT / 'tools' / 'lockfile' / '.terraform.lock.hcl'
+      if lockfile.exists():
+        shutil.copy(lockfile, tmp_path / '.terraform.lock.hcl')
 
       yield tmp_path
   else:
@@ -94,7 +99,7 @@ def plan_summary(module_path, basedir, tf_var_files=None, extra_files=None,
   """
   # make the module_path relative to the root of the repo while still
   # supporting absolute paths
-  module_path = Path(__file__).parents[1] / module_path
+  module_path = _REPO_ROOT / module_path
   with _prepare_root_module(module_path) as test_path:
     binary = os.environ.get('TERRAFORM', 'terraform')
     tf = tftest.TerraformTest(test_path, binary=binary)
diff --git a/tools/lockfile/main.tf b/tools/lockfile/main.tf
new file mode 100644
index 00000000..e9914471
--- /dev/null
+++ b/tools/lockfile/main.tf
@@ -0,0 +1,26 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+resource "local_file" "default" {}
+resource "google_service_account" "sa1" {}
+resource "google_service_account" "sa2" {
+  provider = google-beta
+}
+resource "random_pet" "default" {}
+resource "tls_private_key" "default" {}
+resource "github_branch" "default" {}
+resource "time_static" "default" {}
+resource "vsphere_role" "default" {}
+resource "azurerm_resource_group" "default" {}
+resource "azuread_user" "default" {}