diff --git a/helper/fetch-channel b/helper/fetch-channel
new file mode 100755
index 0000000..708e4ec
--- /dev/null
+++ b/helper/fetch-channel
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+rev=$1
+sha256=$(nix-prefetch-url --unpack https://github.com/nixos/nixpkgs-channels/archive/$rev.tar.gz)
+echo "rev = \"$rev\";"
+echo "sha256 = \"$sha256\";"
diff --git a/pkgs/nixpkgs-pinned.nix b/pkgs/nixpkgs-pinned.nix
index b3ca47f..2b7a2c8 100644
--- a/pkgs/nixpkgs-pinned.nix
+++ b/pkgs/nixpkgs-pinned.nix
@@ -1,7 +1,18 @@
 let
-  fetch = rev: builtins.fetchTarball "https://github.com/nixos/nixpkgs-channels/archive/${rev}.tar.gz";
+  fetch = { rev, sha256 }:
+    builtins.fetchTarball {
+      url = "https://github.com/nixos/nixpkgs-channels/archive/${rev}.tar.gz";
+      inherit sha256;
+    };
 in
 {
-  nixpkgs = fetch "27a5ddcf747fb2bb81ea9c63f63f2eb3eec7a2ec";
-  nixpkgs-unstable = fetch "4cd2cb43fb3a87f48c1e10bb65aee99d8f24cb9d";
+  # To update, run ../helper/fetch-channel REV
+  nixpkgs = fetch {
+    rev = "27a5ddcf747fb2bb81ea9c63f63f2eb3eec7a2ec";
+    sha256 = "1bp11q2marsqj3g2prdrghkhmv483ab5pi078d83xkhkk2jh3h81";
+  };
+  nixpkgs-unstable = fetch {
+    rev = "4cd2cb43fb3a87f48c1e10bb65aee99d8f24cb9d";
+    sha256 = "1d6rmq67kdg5gmk94wx2774qw89nvbhy6g1f2lms3c9ph37hways";
+  };
 }