TIL that `bundle install` will update the lockfile if you're running it with a new version of Ruby! Courtesy of an unpinned `FROM ruby:alpine` in the CI pipeline.
@nertzy That, or using `BUNDLE_FROZEN`, since `vendor/bundle` isn't exactly necessary in a container, but I'd probably prefer `bundle install` to never update the lockfile and have `bundle update` do that instead.