diff --git a/Makefile b/Makefile
index 3366cb9..63a6534 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@
 include config.env
 export $(shell sed 's/=.*//' config.env)
 
-.PHONY: setup add-genome status lint clean help
+.PHONY: setup add-genome status lint lock help
 
 help:
 	@echo "Available commands:"
@@ -14,6 +14,7 @@ help:
 	@echo "  make add-genome    - Register and scaffold a new genome"
 	@echo "  make status        - Check submodule and encryption status"
 	@echo "  make lint          - Verify schema, privacy flags, and metadata"
+	@echo "  make lock          - Lock all encrypted files across all genomes"
 
 lint:
 	@bash scripts/lint-genomes.sh
@@ -34,3 +35,10 @@ status:
 	@git submodule status
 	@echo "--- Encryption Status (First 10 files) ---"
 	@git-crypt status | head -n 10
+
+lock:
+	@echo "Locking master repository..."
+	@git-crypt lock 2>/dev/null || true
+	@echo "Locking all submodules..."
+	@git submodule foreach 'git-crypt lock 2>/dev/null || true'
+	@echo "All genomes securely locked."