diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 451df14..3d8ff77 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -28,7 +28,7 @@ jobs:
           # A fetch-depth of 0 includes all history and tags for script/version
           fetch-depth: 0
       - name: Bootstrap
-        run: script/bootstrap
+        run: script/bootstrap -f
       - name: Build
         run: script/build
       - name: Test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bc483f..b2bc4fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
 
       - name: 👢 Bootstrap
         run: |
-          script/bootstrap
+          script/bootstrap -f
 
       # Important to trigger a universal build first as package just works with
       # the `mas` binary in finds in the build dir.
@@ -91,7 +91,7 @@ jobs:
 
       - name: 👢 Bootstrap
         run: |
-          script/bootstrap
+          script/bootstrap -f
 
       - name: 🍺 Update Homebrew mas formula
         run: |
@@ -110,7 +110,7 @@ jobs:
 
       - name: 👢 Bootstrap
         run: |
-          script/bootstrap
+          script/bootstrap -f
 
       - name: 🚰 Update mas tap formula
         run: |
diff --git a/Makefile b/Makefile
index 0744125..f3cbb7c 100644
--- a/Makefile
+++ b/Makefile
@@ -72,6 +72,10 @@ init: ## Installs tools.
 
 .PHONY: bootstrap
 bootstrap: ## Installs tools.
+	script/bootstrap -f
+
+.PHONY: bootstrap-update
+bootstrap-update: ## Upgrades and installs tools.
 	script/bootstrap
 
 ################################################################################
diff --git a/script/bootstrap b/script/bootstrap
index c429499..5ae8b6b 100755
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -6,14 +6,43 @@
 # Installs development dependencies and builds project dependencies.
 #
 
+function usage {
+  echo "Usage: bootstrap [-f]"
+  echo "  -f option enables frozen mode"
+  exit 1
+}
+
+frozen=''
+
+# Detect presence of `-f` frozen option
+while getopts "f" opt; do
+  echo "${opt}"
+  case "${opt}" in
+    f)
+      frozen='-f'
+      ;;
+    *)
+      usage 1>&2
+      ;;
+  esac
+done
+
 main() {
   script/clean
 
+
   echo "==> 👢 Bootstrapping"
 
   # Install Homebrew tools
-  rm -f Brewfile.lock.json
-  brew bundle install --no-upgrade --verbose
+  if [[ "${frozen}" == "-f" ]]; then
+    # --no-lock Don't touch Brewfile.lock.json
+    brew bundle install --no-lock --no-upgrade --verbose
+  else
+    # Allow upgrades
+    rm -f Brewfile.lock.json
+    brew bundle install --verbose
+  fi
+
 
   if [[ ! -x "$(command -v mise)" ]]; then
     brew install mise