Yep. What was most important to me was predictable builds and you can roughly accomplish this by using pip-compile: pip-compile -n --generate-hashes requireme

Yep. What was most important to me was predictable builds and you can roughly accomplish this by using pip-compile: pip-compile -n --generate-hashes requirements.txt 2> requirements-compiled.txt Update this and commit to your repository whenever you add a new project. It keeps track of the hashes that each package uses which isn't perfect but is a good stop-gap. Then install packages using requirements-compiled.txt only. Other pure pip/python suggestion welcomed!