diff --git a/Cargo.toml b/Cargo.toml
index 16bae986d..f8ecee871 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -40,6 +40,26 @@ include = [
     "/SECURITY.md",
 ]
 
+[package.metadata.binstall]
+pkg-fmt = "tgz"
+bin-dir = "provenant{ binary-ext }"
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-musl]
+pkg-url = "{ repo }/releases/download/v{ version }/provenant-linux-x86_64.tar.gz"
+
+[package.metadata.binstall.overrides.aarch64-unknown-linux-musl]
+pkg-url = "{ repo }/releases/download/v{ version }/provenant-linux-aarch64.tar.gz"
+
+[package.metadata.binstall.overrides.x86_64-apple-darwin]
+pkg-url = "{ repo }/releases/download/v{ version }/provenant-macos-x86_64.tar.gz"
+
+[package.metadata.binstall.overrides.aarch64-apple-darwin]
+pkg-url = "{ repo }/releases/download/v{ version }/provenant-macos-aarch64.tar.gz"
+
+[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/v{ version }/provenant-windows-x86_64.zip"
+pkg-fmt = "zip"
+
 [package.metadata.cargo-machete]
 ignored = ["md-5", "kamadak-exif"]
 
diff --git a/README.md b/README.md
index b5a580ab6..49770866f 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ brew install getprovenant/tap/provenant
 provenant scan --json-pp - --license --package /path/to/repo
 ```
 
-Not on Homebrew (or on Windows)? `cargo install provenant-cli`, grab a [prebuilt archive](https://github.com/getprovenant/provenant/releases), or run the [container image](#container-image).
+Not on Homebrew (or on Windows)? `cargo install --locked provenant-cli`, grab a [prebuilt archive](https://github.com/getprovenant/provenant/releases), or run the [container image](#container-image).
 
 ## Why Provenant?
 
@@ -75,9 +75,11 @@ Installs a prebuilt `provenant` binary from the [Provenant tap](https://github.c
 Install the crates.io package `provenant-cli`:
 
 ```sh
-cargo install provenant-cli
+cargo install --locked provenant-cli
 ```
 
+`--locked` builds against the dependency versions we tested, instead of re-resolving to the newest releases.
+
 This installs the `provenant` command-line binary.
 
 ### Download Precompiled Binary