For NixOS and Home Manager, I ended up going a different direction for now, somewhat inspired by Pinning NixOS with npins, this time without flakes for real | piegames.de.
By default, rebuilding the NixOS or Home Manager config will build it using the same channel versions as the current generation. This is done by pointing NIX_PATH at symlinks in /etc or $HOME/.local/state that are managed by the config. To build with a new version (after npins update), I wrote a script that loads the npins (or any other similar attribute set) into NIX_PATH.