diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index a1d5d2e..631ad86 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -65,6 +65,15 @@
 .reusable_build_test_all: &reusable_build_test_all
   build_targets: ["..."]
   test_targets: ["..."]
+.lockfile_mode_error: &lockfile_mode_error
+  # For testing lockfile support
+  skip_in_bazel_downstream_pipeline: "Lockfile depends on the bazel version"
+  build_flags:
+    - "--lockfile_mode=error"
+  test_flags:
+    - "--lockfile_mode=error"
+  coverage_flags:
+    - "--lockfile_mode=error"
 .coverage_targets_example_bzlmod: &coverage_targets_example_bzlmod
   coverage_targets: ["..."]
 .coverage_targets_example_bzlmod_build_file_generation: &coverage_targets_example_bzlmod_build_file_generation
@@ -230,12 +239,6 @@
     name: "examples/bzlmod: Ubuntu, minimum Bazel"
     working_directory: examples/bzlmod
     platform: ubuntu2004
-    build_flags:
-      - "--lockfile_mode=update"
-    test_flags:
-      - "--lockfile_mode=update"
-    coverage_flags:
-      - "--lockfile_mode=update"
   integration_test_bzlmod_ubuntu:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod
@@ -260,6 +263,20 @@
     name: "examples/bzlmod: Windows"
     working_directory: examples/bzlmod
     platform: windows
+  integration_test_bzlmod_ubuntu_lockfile:
+    <<: *reusable_build_test_all
+    <<: *coverage_targets_example_bzlmod
+    <<: *lockfile_mode_error
+    name: "examples/bzlmod: Ubuntu with lockfile"
+    working_directory: examples/bzlmod
+    platform: ubuntu2004
+  integration_test_bzlmod_macos_lockfile:
+    <<: *reusable_build_test_all
+    <<: *coverage_targets_example_bzlmod
+    <<: *lockfile_mode_error
+    name: "examples/bzlmod: macOS with lockfile"
+    working_directory: examples/bzlmod
+    platform: macos
 
   integration_test_bzlmod_generate_build_file_generation_ubuntu_min:
     <<: *minimum_supported_version
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 54aa043..38b9161 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -45,3 +45,9 @@
         entry: bazel run @rules_bazel_integration_test//tools:update_deleted_packages
         files: ^((examples|tests)/.*/(MODULE.bazel|WORKSPACE|WORKSPACE.bzlmod|BUILD.bazel)|.bazelrc)$
         pass_filenames: false
+      - id: update-bzlmod-lockfiles
+        name: Update bzlmod lockfiles
+        language: script
+        entry: ./tools/private/update_bzlmod_lockfiles.sh
+        files: ^python/
+        pass_filenames: false
diff --git a/examples/bzlmod/.bazelrc b/examples/bzlmod/.bazelrc
index 64e17c3..fd16095 100644
--- a/examples/bzlmod/.bazelrc
+++ b/examples/bzlmod/.bazelrc
@@ -1,8 +1,5 @@
 common --enable_bzlmod
-
-# Update the lockfile by running:
-# bazel mod deps --lockfile_mode=update
-common --lockfile_mode=error
+common --lockfile_mode=update
 
 coverage --java_runtime_version=remotejdk_11
 
diff --git a/examples/bzlmod/.bazelversion b/examples/bzlmod/.bazelversion
new file mode 100644
index 0000000..643916c
--- /dev/null
+++ b/examples/bzlmod/.bazelversion
@@ -0,0 +1 @@
+7.3.1
diff --git a/tools/private/update_bzlmod_lockfiles.sh b/tools/private/update_bzlmod_lockfiles.sh
new file mode 100755
index 0000000..309d64e
--- /dev/null
+++ b/tools/private/update_bzlmod_lockfiles.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+cd "$(dirname "$0")"/../../examples/bzlmod
+bazel mod deps