diff --git a/bundled-provides.jq b/bundled-provides.jq
new file mode 100755
index 0000000..3559f2d
--- /dev/null
+++ b/bundled-provides.jq
@@ -0,0 +1,11 @@
+#!/usr/bin/env -S jq --sort-keys --raw-output --from-file
+
+# To be run from a cargo workspace as:
+# cargo metadata --locked --format-version 1 | CRATE_NAME="zincati" bundled-provides.jq
+
+.packages[] |
+  select(.name != env.CRATE_NAME) |
+  "Provides: " +
+  "bundled(crate(" + .name + "))" +
+  " = " +
+  ( .version | gsub("-"; "_") )
diff --git a/rust-zincati.spec b/rust-zincati.spec
index 645271e..6ff5732 100644
--- a/rust-zincati.spec
+++ b/rust-zincati.spec
@@ -1,7 +1,12 @@
 # Generated by rust2rpm 15
 %bcond_without check
-%global __cargo_skip_build 0
 
+# Whether to use vendor tarball. This should stay off in the steady state
+# when all versioned crate depedencies are packaged, but can be occasionally
+# enabled in order to decouple lifecycles.
+%global with_bundled 1
+
+%global __cargo_skip_build 0
 %global crate zincati
 
 Name:           rust-%{crate}
@@ -14,7 +19,9 @@ License:        ASL 2.0
 URL:            https://crates.io/crates/%{crate}
 Source0:        %{crates_source}
 Source1:        https://github.com/coreos/%{crate}/releases/download/v%{version}/%{crate}-%{version}-vendor.tar.gz
+%if ! 0%{?with_bundled}
 Patch0:         fedora-zincati-cargo-manifest-overrides.diff
+%endif
 
 ExclusiveArch:  %{rust_arches}
 
@@ -24,6 +31,234 @@ BuildRequires:  pkgconfig(openssl)
 
 Requires:       polkit
 
+# List of bundled crate in vendor tarball, generated with:
+# cargo metadata --locked --format-version 1 | CRATE_NAME="zincati" bundled-provides.jq
+%if 0%{?with_bundled}
+Provides: bundled(crate(actix)) = 0.11.1
+Provides: bundled(crate(actix-rt)) = 2.2.0
+Provides: bundled(crate(actix_derive)) = 0.6.0
+Provides: bundled(crate(aho-corasick)) = 0.7.15
+Provides: bundled(crate(ansi_term)) = 0.11.0
+Provides: bundled(crate(anyhow)) = 1.0.40
+Provides: bundled(crate(assert-json-diff)) = 2.0.1
+Provides: bundled(crate(async-io)) = 1.3.1
+Provides: bundled(crate(atty)) = 0.2.14
+Provides: bundled(crate(autocfg)) = 1.0.1
+Provides: bundled(crate(base64)) = 0.13.0
+Provides: bundled(crate(bit-set)) = 0.5.2
+Provides: bundled(crate(bit-vec)) = 0.6.3
+Provides: bundled(crate(bitflags)) = 1.2.1
+Provides: bundled(crate(block-buffer)) = 0.7.3
+Provides: bundled(crate(block-padding)) = 0.1.5
+Provides: bundled(crate(bumpalo)) = 3.4.0
+Provides: bundled(crate(byte-tools)) = 0.3.1
+Provides: bundled(crate(byteorder)) = 1.4.2
+Provides: bundled(crate(bytes)) = 1.0.1
+Provides: bundled(crate(cache-padded)) = 1.1.1
+Provides: bundled(crate(cc)) = 1.0.66
+Provides: bundled(crate(cfg-if)) = 0.1.10
+Provides: bundled(crate(cfg-if)) = 1.0.0
+Provides: bundled(crate(chrono)) = 0.4.19
+Provides: bundled(crate(clap)) = 2.33.3
+Provides: bundled(crate(colored)) = 2.0.0
+Provides: bundled(crate(concurrent-queue)) = 1.2.2
+Provides: bundled(crate(core-foundation)) = 0.9.1
+Provides: bundled(crate(core-foundation-sys)) = 0.8.2
+Provides: bundled(crate(crossbeam-channel)) = 0.5.1
+Provides: bundled(crate(crossbeam-utils)) = 0.8.3
+Provides: bundled(crate(crypto-mac)) = 0.7.0
+Provides: bundled(crate(derivative)) = 2.2.0
+Provides: bundled(crate(difference)) = 2.0.0
+Provides: bundled(crate(digest)) = 0.8.1
+Provides: bundled(crate(encoding_rs)) = 0.8.26
+Provides: bundled(crate(enumflags2)) = 0.6.4
+Provides: bundled(crate(enumflags2_derive)) = 0.6.4
+Provides: bundled(crate(env_logger)) = 0.8.3
+Provides: bundled(crate(envsubst)) = 0.2.0
+Provides: bundled(crate(error-chain)) = 0.12.4
+Provides: bundled(crate(fail)) = 0.4.0
+Provides: bundled(crate(fake-simd)) = 0.1.2
+Provides: bundled(crate(fastrand)) = 1.4.0
+Provides: bundled(crate(filetime)) = 0.2.14
+Provides: bundled(crate(fn-error-context)) = 0.1.2
+Provides: bundled(crate(fnv)) = 1.0.7
+Provides: bundled(crate(foreign-types)) = 0.3.2
+Provides: bundled(crate(foreign-types-shared)) = 0.1.1
+Provides: bundled(crate(form_urlencoded)) = 1.0.0
+Provides: bundled(crate(futures)) = 0.3.14
+Provides: bundled(crate(futures-channel)) = 0.3.14
+Provides: bundled(crate(futures-core)) = 0.3.14
+Provides: bundled(crate(futures-executor)) = 0.3.14
+Provides: bundled(crate(futures-io)) = 0.3.14
+Provides: bundled(crate(futures-lite)) = 1.11.3
+Provides: bundled(crate(futures-macro)) = 0.3.14
+Provides: bundled(crate(futures-sink)) = 0.3.14
+Provides: bundled(crate(futures-task)) = 0.3.14
+Provides: bundled(crate(futures-util)) = 0.3.14
+Provides: bundled(crate(generic-array)) = 0.12.3
+Provides: bundled(crate(getrandom)) = 0.1.16
+Provides: bundled(crate(getrandom)) = 0.2.1
+Provides: bundled(crate(glob)) = 0.3.0
+Provides: bundled(crate(h2)) = 0.3.2
+Provides: bundled(crate(hashbrown)) = 0.9.1
+Provides: bundled(crate(heck)) = 0.3.2
+Provides: bundled(crate(hermit-abi)) = 0.1.17
+Provides: bundled(crate(hmac)) = 0.7.1
+Provides: bundled(crate(http)) = 0.2.4
+Provides: bundled(crate(http-body)) = 0.4.1
+Provides: bundled(crate(httparse)) = 1.3.4
+Provides: bundled(crate(httpdate)) = 0.3.2
+Provides: bundled(crate(humantime)) = 2.0.1
+Provides: bundled(crate(hyper)) = 0.14.5
+Provides: bundled(crate(hyper-tls)) = 0.5.0
+Provides: bundled(crate(idna)) = 0.2.0
+Provides: bundled(crate(indexmap)) = 1.6.1
+Provides: bundled(crate(instant)) = 0.1.9
+Provides: bundled(crate(intervaltree)) = 0.2.6
+Provides: bundled(crate(ipnet)) = 2.3.0
+Provides: bundled(crate(itoa)) = 0.4.7
+Provides: bundled(crate(js-sys)) = 0.3.46
+Provides: bundled(crate(lazy_static)) = 1.4.0
+Provides: bundled(crate(libc)) = 0.2.94
+Provides: bundled(crate(liboverdrop)) = 0.0.2
+Provides: bundled(crate(libsystemd)) = 0.2.1
+Provides: bundled(crate(lock_api)) = 0.4.2
+Provides: bundled(crate(log)) = 0.4.14
+Provides: bundled(crate(maplit)) = 1.0.2
+Provides: bundled(crate(matches)) = 0.1.8
+Provides: bundled(crate(memchr)) = 2.3.4
+Provides: bundled(crate(mime)) = 0.3.16
+Provides: bundled(crate(mio)) = 0.7.11
+Provides: bundled(crate(miow)) = 0.3.7
+Provides: bundled(crate(mockito)) = 0.30.0
+Provides: bundled(crate(native-tls)) = 0.2.7
+Provides: bundled(crate(nb-connect)) = 1.0.3
+Provides: bundled(crate(nix)) = 0.17.0
+Provides: bundled(crate(ntapi)) = 0.3.6
+Provides: bundled(crate(num-integer)) = 0.1.44
+Provides: bundled(crate(num-traits)) = 0.2.14
+Provides: bundled(crate(num_cpus)) = 1.13.0
+Provides: bundled(crate(once_cell)) = 1.5.2
+Provides: bundled(crate(opaque-debug)) = 0.2.3
+Provides: bundled(crate(openssl)) = 0.10.32
+Provides: bundled(crate(openssl-probe)) = 0.1.2
+Provides: bundled(crate(openssl-sys)) = 0.9.60
+Provides: bundled(crate(ordered-float)) = 2.1.1
+Provides: bundled(crate(parking)) = 2.0.0
+Provides: bundled(crate(parking_lot)) = 0.11.1
+Provides: bundled(crate(parking_lot_core)) = 0.8.2
+Provides: bundled(crate(percent-encoding)) = 2.1.0
+Provides: bundled(crate(pin-project)) = 1.0.4
+Provides: bundled(crate(pin-project-internal)) = 1.0.4
+Provides: bundled(crate(pin-project-lite)) = 0.2.4
+Provides: bundled(crate(pin-utils)) = 0.1.0
+Provides: bundled(crate(pkg-config)) = 0.3.19
+Provides: bundled(crate(polling)) = 2.0.2
+Provides: bundled(crate(ppv-lite86)) = 0.2.10
+Provides: bundled(crate(proc-macro-crate)) = 0.1.5
+Provides: bundled(crate(proc-macro-error)) = 1.0.4
+Provides: bundled(crate(proc-macro-error-attr)) = 1.0.4
+Provides: bundled(crate(proc-macro-hack)) = 0.5.19
+Provides: bundled(crate(proc-macro-nested)) = 0.1.6
+Provides: bundled(crate(proc-macro2)) = 1.0.24
+Provides: bundled(crate(prometheus)) = 0.12.0
+Provides: bundled(crate(proptest)) = 1.0.0
+Provides: bundled(crate(quick-error)) = 1.2.3
+Provides: bundled(crate(quick-error)) = 2.0.0
+Provides: bundled(crate(quote)) = 1.0.8
+Provides: bundled(crate(rand)) = 0.7.3
+Provides: bundled(crate(rand)) = 0.8.3
+Provides: bundled(crate(rand_chacha)) = 0.2.2
+Provides: bundled(crate(rand_chacha)) = 0.3.0
+Provides: bundled(crate(rand_core)) = 0.5.1
+Provides: bundled(crate(rand_core)) = 0.6.1
+Provides: bundled(crate(rand_hc)) = 0.2.0
+Provides: bundled(crate(rand_hc)) = 0.3.0
+Provides: bundled(crate(rand_xorshift)) = 0.3.0
+Provides: bundled(crate(redox_syscall)) = 0.1.57
+Provides: bundled(crate(redox_syscall)) = 0.2.4
+Provides: bundled(crate(regex)) = 1.4.6
+Provides: bundled(crate(regex-syntax)) = 0.6.22
+Provides: bundled(crate(remove_dir_all)) = 0.5.3
+Provides: bundled(crate(reqwest)) = 0.11.3
+Provides: bundled(crate(rusty-fork)) = 0.3.0
+Provides: bundled(crate(ryu)) = 1.0.5
+Provides: bundled(crate(schannel)) = 0.1.19
+Provides: bundled(crate(scoped-tls)) = 1.0.0
+Provides: bundled(crate(scopeguard)) = 1.1.0
+Provides: bundled(crate(security-framework)) = 2.0.0
+Provides: bundled(crate(security-framework-sys)) = 2.0.0
+Provides: bundled(crate(serde)) = 1.0.125
+Provides: bundled(crate(serde_derive)) = 1.0.125
+Provides: bundled(crate(serde_json)) = 1.0.64
+Provides: bundled(crate(serde_repr)) = 0.1.6
+Provides: bundled(crate(serde_urlencoded)) = 0.7.0
+Provides: bundled(crate(sha2)) = 0.8.2
+Provides: bundled(crate(signal-hook-registry)) = 1.3.0
+Provides: bundled(crate(slab)) = 0.4.2
+Provides: bundled(crate(smallvec)) = 1.6.1
+Provides: bundled(crate(socket2)) = 0.3.19
+Provides: bundled(crate(socket2)) = 0.4.0
+Provides: bundled(crate(strsim)) = 0.8.0
+Provides: bundled(crate(structopt)) = 0.3.21
+Provides: bundled(crate(structopt-derive)) = 0.4.14
+Provides: bundled(crate(subtle)) = 1.0.0
+Provides: bundled(crate(syn)) = 1.0.60
+Provides: bundled(crate(tempfile)) = 3.2.0
+Provides: bundled(crate(termcolor)) = 1.1.2
+Provides: bundled(crate(textwrap)) = 0.11.0
+Provides: bundled(crate(thiserror)) = 1.0.24
+Provides: bundled(crate(thiserror-impl)) = 1.0.24
+Provides: bundled(crate(time)) = 0.1.43
+Provides: bundled(crate(tinyvec)) = 1.1.0
+Provides: bundled(crate(tinyvec_macros)) = 0.1.0
+Provides: bundled(crate(tokio)) = 1.5.0
+Provides: bundled(crate(tokio-native-tls)) = 0.3.0
+Provides: bundled(crate(tokio-util)) = 0.6.6
+Provides: bundled(crate(toml)) = 0.5.8
+Provides: bundled(crate(tower-service)) = 0.3.0
+Provides: bundled(crate(tracing)) = 0.1.22
+Provides: bundled(crate(tracing-core)) = 0.1.17
+Provides: bundled(crate(try-lock)) = 0.2.3
+Provides: bundled(crate(typenum)) = 1.12.0
+Provides: bundled(crate(tzfile)) = 0.1.3
+Provides: bundled(crate(unicode-bidi)) = 0.3.4
+Provides: bundled(crate(unicode-normalization)) = 0.1.16
+Provides: bundled(crate(unicode-segmentation)) = 1.7.1
+Provides: bundled(crate(unicode-width)) = 0.1.8
+Provides: bundled(crate(unicode-xid)) = 0.2.1
+Provides: bundled(crate(url)) = 2.2.1
+Provides: bundled(crate(users)) = 0.11.0
+Provides: bundled(crate(uuid)) = 0.8.2
+Provides: bundled(crate(vcpkg)) = 0.2.11
+Provides: bundled(crate(vec-arena)) = 1.0.0
+Provides: bundled(crate(vec_map)) = 0.8.2
+Provides: bundled(crate(version_check)) = 0.9.2
+Provides: bundled(crate(void)) = 1.0.2
+Provides: bundled(crate(wait-timeout)) = 0.2.0
+Provides: bundled(crate(waker-fn)) = 1.1.0
+Provides: bundled(crate(want)) = 0.3.0
+Provides: bundled(crate(wasi)) = 0.9.0+wasi_snapshot_preview1
+Provides: bundled(crate(wasi)) = 0.10.1+wasi_snapshot_preview1
+Provides: bundled(crate(wasm-bindgen)) = 0.2.69
+Provides: bundled(crate(wasm-bindgen-backend)) = 0.2.69
+Provides: bundled(crate(wasm-bindgen-futures)) = 0.4.19
+Provides: bundled(crate(wasm-bindgen-macro)) = 0.2.69
+Provides: bundled(crate(wasm-bindgen-macro-support)) = 0.2.69
+Provides: bundled(crate(wasm-bindgen-shared)) = 0.2.69
+Provides: bundled(crate(web-sys)) = 0.3.46
+Provides: bundled(crate(wepoll-sys)) = 3.0.1
+Provides: bundled(crate(winapi)) = 0.3.9
+Provides: bundled(crate(winapi-i686-pc-windows-gnu)) = 0.4.0
+Provides: bundled(crate(winapi-util)) = 0.1.5
+Provides: bundled(crate(winapi-x86_64-pc-windows-gnu)) = 0.4.0
+Provides: bundled(crate(winreg)) = 0.7.0
+Provides: bundled(crate(zbus)) = 1.9.1
+Provides: bundled(crate(zbus_macros)) = 1.9.1
+Provides: bundled(crate(zvariant)) = 2.6.0
+Provides: bundled(crate(zvariant_derive)) = 2.6.0
+%endif
+
 %global _description %{expand:
 Update agent for Fedora CoreOS.}
 
@@ -76,11 +311,37 @@ License:        ASL 2.0 and BSD and MIT and MPLv2.0 and zlib
 %systemd_postun_with_restart zincati.service
 
 %prep
-%autosetup -n %{crate}-%{version_no_tilde} -p1
+%autosetup -N -n %{crate}-%{version_no_tilde}
+%if ! 0%{?with_bundled}
 %cargo_prep
+%else
+tar xvf %{SOURCE1}
+mkdir -p .cargo
+cat >.cargo/config << EOF
+[build]
+rustc = "%{__rustc}"
+rustdoc = "%{__rustdoc}"
+rustflags = %{__global_rustflags_toml}
 
+[install]
+root = "%{buildroot}%{_prefix}"
+
+[term]
+verbose = true
+
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+EOF
+%endif
+%autopatch -p1
+
+%if ! 0%{?with_bundled}
 %generate_buildrequires
 %cargo_generate_buildrequires
+%endif
 
 %build
 %cargo_build
@@ -121,6 +382,7 @@ ln -snf /run/%{crate}/public/metrics.promsock %{buildroot}/run/%{crate}/private/
 * Tue May 04 2021 Luca BRUNO <lucab@lucabruno.net> - 0.0.20-1
 - New upstream version
   https://github.com/coreos/zincati/releases/tag/v0.0.20
+- Temporarily use bundled crates from vendor tarball
 
 * Tue Mar 23 2021 Kelvin Fan <kfan@redhat.com> - 0.0.19-1
 - New upstream version