You can pin the commit of nixpkgs. Why should reproducibility hold when nixpkgs changes?