I hard-code ("freeze") known-good versions of dependencies (including nixpkgs) in my derivations; but I also check to see if an override has been given in NIX_P

I hard-code ("freeze") known-good versions of dependencies (including nixpkgs) in my derivations; but I also check to see if an override has been given in NIX_PATH (using `builtins.tryEval <foo>`). This way, I can override things if needed; and in particular I have continuous integration (Hydra) building both a "stable" (all fixed versions) and "unstable" (all latest versions). This way I always have a known-good build I can use, but I can still spot impending breakages and bit-rot in CI. In the case of nixpkgs I don't actually track the very latest commit, since it updates so often. Instead I just `git pull` into a fork every now and again.