How does one pin NixOS to a specific version of nixpkgs? (edited to add: don't, or else you'll miss out on security updates)

I know how to pin nixpkgs to a specific version (FAQ/Pinning Nixpkgs - NixOS Wiki), but I don’t know how to pin the whole of NixOS. (Specifically, the derivation for stumpwm is broken in unstable, and ideally I’d like to use a version of unstable from a couple of weeks ago. Since stumpwm is a window manager, its version depends on NixOS - it can’t just be pulled in as a package, AFAIK.)

Thank you!

1 Like

The stumpwm module is just a simple wrapper around services.xserver.windowManager.session, so you could just use the pinning instructions to fetch a specific nixpkgs version and then using that for the stumpwm session. For example (untested):

services.xserver.windowManager.session = let
  nixpkgs-pinned = import (builtins.fetchTarball {
    name = "nixos-unstable-2018-09-12";
    url = "";
    sha256 = "1jg7g6cfpw8qvma0y19kwyp549k1qyf11a5sg6hvn6awvmkny47v";
  }) {};
in [ {
  name = "stumpwm";
  start = ''
    ${nixpkgs-pinned.lispPackages.stumpwm}/bin/stumpwm &
} ];

The downside of pinning all of nixpkgs to a specific revision is that you miss out on security updates. With this approach, only stumpwm is stale.


Ah, yes, good point.

Thank you for the configuration code. When I try that, on rebuilding I get:

error: Cannot merge definitions of services.xserver.windowManager.session' given in /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/services/x11/window-managers/stumpwm.nix’ and /etc/nixos/configuration.nix' and /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/services/x11/window-managers/none.nix’.

As I said, it’s untested, so you may have to fix up things a bit. First of all, the attribute set curly braces were missing :wink: , which I added to the example now. Also: have you removed services.xserver.windowManager.stumpwm.enable = true; from your configuration?

1 Like

The problem was that I’d changed a couple of the square brackets into curly brackets instead of ADDING curly brackets. Your fixed example works. \o/

Thank you so much for your help!

1 Like

That being said, fixing the nixpkgs revision in your system config is still a nice thing to do for reproducibility. That way you can easily rollback you system to any previous configuration, including the nixpkgs revision. You just need to remember to regularly update this pin.

I currently do this by

This has the effect that nix-rebuild always remembers the last nixpkgs revision that was explicitly prvoided through NIX_PATH and uses that until a new version is provided in NIX_PATH (as done in the rebuild script). It keeps home-manager and nixos in sync. It’s an alternative to channels.

More complicated than it should be, but worth it in my view.


@timokau That is a nice trick using extraSystemBuilderCmds to get the systems version of nixpkgs! Maybe that’s worth making an option for it in the NixOS modules?

I agree.

This is going to get easier when we have flakes, isn’t it?