Record the choice once.
A URL such as github:NixOS/nixpkgs/nixos-unstable points at a moving branch. The lock file records its resolved revision and content hash, together with other input relationships. Normal use can then reuse those recorded inputs.
Create the lock and inspect what was resolved. In a Git repository, add new flake source files to Git so Nix includes them in the source snapshot.
git init
git add flake.nix
nix flake lock
git add flake.lock
nix flake metadata
git commit -m "Add and lock Nix project"
Treat dependency updates as changes.
Use nix flake update nixpkgs to update that named input. Use nix flake update to update all inputs. Read the diff and rebuild or test your project before committing.
Locking inputs does not guarantee that every build is deterministic or that an input will remain available forever. It makes the source revisions explicit and reviewable.
nix flake update nixpkgs
git diff -- flake.lock
nix flake check
# After reviewing and testing:
git add flake.lock
git commit -m "Update Nixpkgs input"
Keep the lock file in Git; update it as an intentional dependency change.