diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
index 7c60c583..754f076e 100644
--- a/.github/workflows/run-tests.yaml
+++ b/.github/workflows/run-tests.yaml
@@ -113,6 +113,26 @@ jobs:
       if: steps.wasm-build.outputs.cache-hit != 'true'
       run: bash build.sh main
 
+    - name: Check all transitive dependencies are pinned
+      if: steps.wasm-build.outputs.cache-hit != 'true'
+      shell: /bin/bash -e {0}
+      run: |
+        cat extern/CMakeLists.txt | \
+            grep "FetchContent_MakeAvailable" | \
+            sed "s/FetchContent_MakeAvailable(//" | \
+            sed "s/)//" | \
+            tr '[:upper:]' '[:lower:]' | \
+            sort > requested.txt
+        ls build_main/_deps/ | \
+            grep "src$" | \
+            sed "s/-src//" | \
+            sort > observed.txt
+        diffs=$(diff observed.txt requested.txt )
+        if [[ $diffs != '' ]]
+        then
+            exit 1
+        fi
+
     - name: Run tests
       run: |
         export CHECK_RDS=1
diff --git a/extern/CMakeLists.txt b/extern/CMakeLists.txt
index 94ce1bc6..969744c1 100644
--- a/extern/CMakeLists.txt
+++ b/extern/CMakeLists.txt
@@ -212,6 +212,7 @@ FetchContent_Declare(
   GIT_TAG v1.1.0
 )
 
+FetchContent_MakeAvailable(aarand)
 FetchContent_MakeAvailable(subpar)
 
 FetchContent_MakeAvailable(tatami)