diff --git a/composer.json b/composer.json
index 51f04bf..cdf4bd9 100644
--- a/composer.json
+++ b/composer.json
@@ -13,7 +13,7 @@
     ],
     "_comment": [
         "composer/composer is not a dev requirement because this library depends on code from that",
-        "drupal/core-dev is here but the dependent package also must also require it otherwise it could happen that incorrect/unmatching versions gets installed with drupal/core and drupal/core-recommended"
+        "mglaman/drupal-check is locked on <=1.2.1 because newer versions produces malformed JSON output and run PHPStan on level 2. See: https://github.com/mglaman/drupal-check/issues/274 and https://mglaman.dev/blog/drupal-check-140-enforcing-phpstan-level-2"
     ],
     "require": {
         "php": "^7.4.0",
@@ -28,7 +28,7 @@
         "ergebnis/composer-normalize": "^2.13.0",
         "friendsoftwig/twigcs": "^3.1",
         "instaclick/php-webdriver": "^1.4.5",
-        "mglaman/drupal-check": "^1.2",
+        "mglaman/drupal-check": "<=1.2.1",
         "phpspec/prophecy-phpunit": "^2",
         "phpstan/phpstan": "^1.2",
         "pronovix/composer-logger": "^3.0",