diff --git a/.circleci/config.yml b/.circleci/config.yml
index f933ddb..e2ea517 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -62,6 +62,12 @@ jobs:
           name: Build stack programs
           command: |
             set -e
+            # reinstall stack using the latest hackage-security
+            # as a possible workaround for the locking issue (#29)
+            stack --version
+            stack install stack
+            stack --version
+            stack exec ghc-pkg list stackage-security
             stack install stackage-curator
             stack install
       - run:
diff --git a/stack.yaml b/stack.yaml
index 53740a1..41fd3b2 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -5,6 +5,10 @@ packages:
     git: git@github.com:fpco/stackage-curator.git
     commit: eaeba273bdd38f121ad200b2a876227e666f86a2
   extra-dep: true
+- location:
+    git: https://github.com/haskell/hackage-security.git
+    commit: d10d0e076636ef3198602c5c9069305530b93072
+  extra-dep: true
 
 nix:
   packages: