What do you mean? If you do "pip freeze >constraints.txt", that locks the versions of all installed packages, no matter where they came from. As an example, le

What do you mean? If you do "pip freeze >constraints.txt", that locks the versions of all installed packages, no matter where they came from. As an example, let's create a venv and install some older versions of Django and its dependencies (current versions are 0.4.2, 3.5.2 and 4.0.6) $ python3 -m venv env1 $ ./env1/bin/pip install sqlparse==0.4.0 asgiref==3.5.0 django=4.0.0 ...and also Flask just to complicate the constraints file for the example: $ ./env1/bin/pip install flask Lock all dependency versions in constraints.txt: $ ./env1/bin/pip freeze >constraints.txt Create a requirements file that specifies just "django" and references the constraints file: $ echo '-c constraints.txt' >requirements.txt $ echo 'django' >>requirements.txt $ cat requirements.txt -c constraints.txt django $ cat constraints.txt asgiref==3.5.0 click==8.1.3 Django==4.0 Flask==2.1.3 itsdangerous==2.1.2 Jinja2==3.1.2 MarkupSafe==2.1.1 sqlparse==0.4.0 Werkzeug==2.1.2 Now we can create another venv with the exact same versions of Django and all its dependencies (but not Flask or its dependencies) using just pip and the requirements file: $ python3 -m venv env2 $ ./env2/bin/pip install -r requirements.txt $ ./env2/bin/pip freeze asgiref==3.5.0 Django==4.0 sqlparse==0.4.0