NixOS is a big fan of reproduceability -- indeed that's what i'm using it for. For a long time I maintained a single versions.nix module full of builtins.fetchGit and fetchFromGitHub invocations whose rev was updated by hand using a modified nix-update-el.

That machinery is gone now. Each third-party source is declared as an #+ARROYO_INPUT: snippet in the org file whose Nix module actually consumes it, and the Arroyo System Flake Generator inlines those snippets into =flake.nix='s inputs block. flake.lock is the single source of truth for revisions; nix flake update <input> replaces the old nix-update-branch-revs / nix-update-decls dance.

Packages built by Arroyo Nix Support's rixpkgs overlay receive the flake inputs via callPackage injection (the rixpkgs-overlay NixOS module stamps inputs into the nixpkgs scope), so a package's formal args just list inputs and reach inputs.<name> directly -- no pkgs.lib.pkgVersions indirection.

Archived notes from the old versions.nix era

The old document used org-auto-tangle with noweb syntax and a prefetch-git-rev elisp helper to fetch latest branch SHAs from the GitHub API and inline them into builtins.fetchGit blocks. #+AUTO_TANGLE: vars:load-path was required to load s.el into the async tangle Emacs. Updating was a manual M-o i / C-u M-o o ritual against nix-update-el. All of that is superseded by nix flake lock --update-input <name>.