diff --git a/recipe_modules/bazel_roll/api.py b/recipe_modules/bazel_roll/api.py
index 274bd61..400908e 100644
--- a/recipe_modules/bazel_roll/api.py
+++ b/recipe_modules/bazel_roll/api.py
@@ -20,9 +20,7 @@
 import re
 from typing import TYPE_CHECKING
 
-from PB.recipe_modules.pigweed.checkout.options import (
-    Options as CheckoutOptions,
-)
+from PB.recipe_modules.pigweed.bazel.options import Options as BazelOptions
 from recipe_engine import recipe_api
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -141,4 +139,16 @@
             return []
 
         update_result.finalize()
+
+        with self.m.step.nest('update MODULE.bazel.lock'):
+            runner = self.m.bazel.new_runner(
+                checkout=checkout,
+                options=BazelOptions(),
+            )
+
+            self.m.step(
+                'bazelisk build --nobuild',
+                [runner.ensure(), 'mod', 'deps', '--lockfile_mode=update'],
+            )
+
         return [roll]
diff --git a/recipe_modules/bazel_roll/tests/full.expected/no-trigger.json b/recipe_modules/bazel_roll/tests/full.expected/no-trigger.json
index 6cac09c..2f2a210 100644
--- a/recipe_modules/bazel_roll/tests/full.expected/no-trigger.json
+++ b/recipe_modules/bazel_roll/tests/full.expected/no-trigger.json
@@ -596,6 +596,61 @@
   },
   {
     "cmd": [],
+    "name": "update MODULE.bazel.lock"
+  },
+  {
+    "cmd": [
+      "cipd",
+      "ensure",
+      "-root",
+      "[CLEANUP]/tmp_tmp_1",
+      "-ensure-file",
+      "fuchsia/third_party/bazelisk/${platform} latest",
+      "-max-threads",
+      "0",
+      "-json-output",
+      "/path/to/tmp/json"
+    ],
+    "name": "update MODULE.bazel.lock.ensure bazelisk",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@",
+      "@@@STEP_LOG_LINE@json.output@{@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"result\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@    \"\": [@@@",
+      "@@@STEP_LOG_LINE@json.output@      {@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"instance_id\": \"resolved-instance_id-of-latest----------\",@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"package\": \"fuchsia/third_party/bazelisk/resolved-platform\"@@@",
+      "@@@STEP_LOG_LINE@json.output@      }@@@",
+      "@@@STEP_LOG_LINE@json.output@    ]@@@",
+      "@@@STEP_LOG_LINE@json.output@  }@@@",
+      "@@@STEP_LOG_LINE@json.output@}@@@",
+      "@@@STEP_LOG_END@json.output@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[CLEANUP]/tmp_tmp_1/bazelisk",
+      "version"
+    ],
+    "name": "update MODULE.bazel.lock.bazel version",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[CLEANUP]/tmp_tmp_1/bazelisk",
+      "mod",
+      "deps",
+      "--lockfile_mode=update"
+    ],
+    "name": "update MODULE.bazel.lock.bazelisk build --nobuild",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [],
     "name": "commit message",
     "~followup_annotations": [
       "@@@STEP_SUMMARY_TEXT@roll: pigweed 1111111..h3ll0 (3 commits)\n\n3e30158:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/12345 fake A msg 0\n3380b83:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/12345 fake A msg 1\n363caa9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/12345 fake A msg 2\n\n\nRolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed\nRolled-Commits: 11111111111111..h3ll0@@@"
diff --git a/recipe_modules/bazel_roll/tests/full.expected/success.json b/recipe_modules/bazel_roll/tests/full.expected/success.json
index bb70039..d85feb4 100644
--- a/recipe_modules/bazel_roll/tests/full.expected/success.json
+++ b/recipe_modules/bazel_roll/tests/full.expected/success.json
@@ -725,6 +725,97 @@
   },
   {
     "cmd": [],
+    "name": "update MODULE.bazel.lock"
+  },
+  {
+    "cmd": [
+      "cipd",
+      "ensure",
+      "-root",
+      "[CLEANUP]/tmp_tmp_1",
+      "-ensure-file",
+      "fuchsia/third_party/bazelisk/${platform} latest",
+      "-max-threads",
+      "0",
+      "-json-output",
+      "/path/to/tmp/json"
+    ],
+    "luci_context": {
+      "realm": {
+        "name": "project:ci"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "update MODULE.bazel.lock.ensure bazelisk",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@",
+      "@@@STEP_LOG_LINE@json.output@{@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"result\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@    \"\": [@@@",
+      "@@@STEP_LOG_LINE@json.output@      {@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"instance_id\": \"resolved-instance_id-of-latest----------\",@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"package\": \"fuchsia/third_party/bazelisk/resolved-platform\"@@@",
+      "@@@STEP_LOG_LINE@json.output@      }@@@",
+      "@@@STEP_LOG_LINE@json.output@    ]@@@",
+      "@@@STEP_LOG_LINE@json.output@  }@@@",
+      "@@@STEP_LOG_LINE@json.output@}@@@",
+      "@@@STEP_LOG_END@json.output@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[CLEANUP]/tmp_tmp_1/bazelisk",
+      "version"
+    ],
+    "luci_context": {
+      "realm": {
+        "name": "project:ci"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "update MODULE.bazel.lock.bazel version",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[CLEANUP]/tmp_tmp_1/bazelisk",
+      "mod",
+      "deps",
+      "--lockfile_mode=update"
+    ],
+    "luci_context": {
+      "realm": {
+        "name": "project:ci"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "update MODULE.bazel.lock.bazelisk build --nobuild",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [],
     "name": "commit message",
     "~followup_annotations": [
       "@@@STEP_SUMMARY_TEXT@roll: pigweed 1111111..2d72510 (3 commits)\n\n3e30158:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/12345 fake A msg 0\n3380b83:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/12345 fake A msg 1\n363caa9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/12345 fake A msg 2\n\n\nRolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed\nRolled-Commits: 11111111111111..2d72510e447ab6@@@"
diff --git a/recipes/bazel_roller.expected/success.json b/recipes/bazel_roller.expected/success.json
index 4740cd5..b984660 100644
--- a/recipes/bazel_roller.expected/success.json
+++ b/recipes/bazel_roller.expected/success.json
@@ -1674,6 +1674,97 @@
     ]
   },
   {
+    "cmd": [],
+    "name": "update MODULE.bazel.lock"
+  },
+  {
+    "cmd": [
+      "cipd",
+      "ensure",
+      "-root",
+      "[CLEANUP]/tmp_tmp_1",
+      "-ensure-file",
+      "fuchsia/third_party/bazelisk/${platform} latest",
+      "-max-threads",
+      "0",
+      "-json-output",
+      "/path/to/tmp/json"
+    ],
+    "luci_context": {
+      "realm": {
+        "name": "project:ci"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "update MODULE.bazel.lock.ensure bazelisk",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@",
+      "@@@STEP_LOG_LINE@json.output@{@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"result\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@    \"\": [@@@",
+      "@@@STEP_LOG_LINE@json.output@      {@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"instance_id\": \"resolved-instance_id-of-latest----------\",@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"package\": \"fuchsia/third_party/bazelisk/resolved-platform\"@@@",
+      "@@@STEP_LOG_LINE@json.output@      }@@@",
+      "@@@STEP_LOG_LINE@json.output@    ]@@@",
+      "@@@STEP_LOG_LINE@json.output@  }@@@",
+      "@@@STEP_LOG_LINE@json.output@}@@@",
+      "@@@STEP_LOG_END@json.output@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[CLEANUP]/tmp_tmp_1/bazelisk",
+      "version"
+    ],
+    "luci_context": {
+      "realm": {
+        "name": "project:ci"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "update MODULE.bazel.lock.bazel version",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[CLEANUP]/tmp_tmp_1/bazelisk",
+      "mod",
+      "deps",
+      "--lockfile_mode=update"
+    ],
+    "luci_context": {
+      "realm": {
+        "name": "project:ci"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "update MODULE.bazel.lock.bazelisk build --nobuild",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
     "cmd": [
       "git",
       "ls-files",