diff --git a/.gitignore b/.gitignore
index f3027d2..deab1a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,6 @@
 /tools/Cargo.lock
 # wit dependencies, fetched by `make wit` from the wkg.toml and wkg.lock files
 **/wit/deps/
+
+# a lock wkg rewrote, kept while `make` checks whether its content changed
+wkg.lock.orig
diff --git a/make/components.mk b/make/components.mk
index a82da73..208942a 100644
--- a/make/components.mk
+++ b/make/components.mk
@@ -79,5 +79,5 @@ ${WAC_DEPS_DIR}: components/wit/deps scripts/wac-deps.sh | $(call tool,wasm-tool
 
 ${COMPONENTS_DIR}/interface.wasm: wit/deps README.md | $(call tool,wkg)
 	@mkdir -p ${COMPONENTS_DIR}
-	$(WKG) build -o ${COMPONENTS_DIR}/interface.wasm
+	$(call wkg,.,build -o $(abspath ${COMPONENTS_DIR})/interface.wasm)
 	@cp README.md ${COMPONENTS_DIR}/README.md
diff --git a/make/publish.mk b/make/publish.mk
index 2b3a472..87c2324 100644
--- a/make/publish.mk
+++ b/make/publish.mk
@@ -3,8 +3,10 @@ SIGN ?= true
 # append each published file and its image to this file, e.g. `gate.wasm ghcr.io/componentized/http/gate:0.1.0@sha256:...`
 PUBLISH_LOG ?=
 
-# the files that can be published, e.g. gate.wasm, published from target/components/gate/gate.wasm
-PUBLISH_FILES := interface.wasm $(foreach component,$(filter-out dep-% test-%,$(COMPONENTS)),$(component).wasm $(component).debug.wasm)
+# the files that can be published, e.g. gate.wasm, published from target/components/gate/gate.wasm.
+# Components are not published when they are pulled from elsewhere, `dep-`, built here for use by
+# other components, `internal-`, or tests, `test-`.
+PUBLISH_FILES := interface.wasm $(foreach component,$(filter-out dep-% internal-% test-%,$(COMPONENTS)),$(component).wasm $(component).debug.wasm)
 
 .PHONY: publish ## Publish each component in the target/components directory
 publish: $(addprefix publish-,$(PUBLISH_FILES))
diff --git a/make/wit.mk b/make/wit.mk
index ac4971c..fc9ea0c 100644
--- a/make/wit.mk
+++ b/make/wit.mk
@@ -10,6 +10,14 @@ wit_deps = $(patsubst ./%,%,$(1)/wit/deps)
 
 WIT_DEPS := $(foreach dir,$(WKG_DIRS),$(call wit_deps,$(dir)))
 
+# runs wkg with the arguments in the directory with a wkg.toml, e.g. `$(call wkg,components,fetch)`.
+# wkg rewrites wkg.lock even when nothing changed, which would leave everything made from the lock
+# looking out of date, so the lock is put back as it was, with its time, when its content is unchanged
+wkg = cp -p $(1)/wkg.lock $(1)/wkg.lock.orig && \
+	(cd $(1) && $(WKG) $(2)); status=$$?; \
+	if cmp -s $(1)/wkg.lock.orig $(1)/wkg.lock; then mv $(1)/wkg.lock.orig $(1)/wkg.lock; else rm $(1)/wkg.lock.orig; fi; \
+	exit $$status
+
 .PHONY: clean-wit ## Remove the fetched wit dependencies, fetched again by `make wit`
 clean-wit:
 	rm -rf $(WIT_DEPS)
@@ -19,9 +27,14 @@ wit: $(WIT_DEPS)
 
 define FETCH_WIT
 
-# a package overridden with a local path, e.g. `{ path = "../wit" }`, has its dependencies fetched first
-$(call wit_deps,$1): $1/wkg.toml $1/wkg.lock $(shell find $1/wit -type f -name "*.wit" -not -path "*/deps/*") $(foreach path,$(shell sed -n 's/.*path *= *"\(.*\)".*/\1/p' $1/wkg.toml),$(call relpath,$1/$(path))/deps) | $(call tool,wkg)
-	$(if $(filter .,$1),,cd $1 && )$(WKG) fetch
+# the dependencies are touched after fetching, newer than the lock they were fetched with even when
+# the fetch changed nothing in them
+#
+# a package overridden with a local path, e.g. `{ path = "../wit" }`, has its dependencies fetched first,
+# an override without dependencies of its own is skipped, e.g. `{ path = "./wit/overrides/wasi-muppets" }`
+$(call wit_deps,$1): $1/wkg.toml $1/wkg.lock $(shell find $1/wit -type f -name "*.wit" -not -path "*/deps/*") $(filter $(WIT_DEPS),$(foreach path,$(shell sed -n 's/.*path *= *"\(.*\)".*/\1/p' $1/wkg.toml),$(call relpath,$1/$(path))/deps)) | $(call tool,wkg)
+	$$(call wkg,$1,fetch)
+	@touch $(call wit_deps,$1)
 
 endef