NixOS is a big fan of reproduceability -- indeed that's what i'm using it for. For a long time I maintained a single versions.nix module full of builtins.fetchGit and fetchFromGitHub invocations whose rev was updated by hand using a modified nix-update-el.
That machinery is gone now. Each third-party source is declared as an #+ARROYO_INPUT: snippet in the org file whose Nix module actually consumes it, and the Arroyo System Flake Generator inlines those snippets into flake.nix's inputs block. flake.lock is the single source of truth for revisions; nix flake update <input> replaces the old nix-update-branch-revs / nix-update-decls dance.
Packages built by Arroyo Nix Support 's rixpkgs overlay receive the flake inputs via callPackage injection (the rixpkgs-overlay NixOS module stamps inputs into the nixpkgs scope), so a package's formal args just list inputs and reach inputs.<name> directly -- no pkgs.lib.pkgVersions indirection.
Archived notes from the old versions.nix era
The old document used org-auto-tangle with noweb syntax and a prefetch-git-rev elisp helper to fetch latest branch SHAs from the GitHub API and inline them into builtins.fetchGit blocks. #+AUTO_TANGLE: vars:load-path was required to load s.el into the async tangle Emacs. Updating was a manual M-o i / C-u M-o o ritual against nix-update-el . All of that is superseded by nix flake lock --update-input <name>.