If you can wrap your build in Nix, I highly recommend it. The upcoming "flakes" feature handles pinning Git-hosted dependencies and locking revisions, even if they aren't Nix flakes themselves.