They are now pinned by default even for shell.
We also started using Niv for easier updating –
one can just run `nix-shell --run 'niv update'`
instead of manually replacing the commit id.