diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..fb9f911
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+cd $(dirname $0)
+
+# assume that if there are no args, you want to switch to the configuration
+cmd=${1:-switch}
+shift
+
+homemanager="/home/nora/.nix-profile/bin/home-manager"
+
+nixpkgs_pin=$(nix eval --raw -f npins/default.nix nixpkgs)
+nixgl_pin=$(nix eval --raw -f npins/default.nix nixgl)
+homemanager_pin=$(nix eval --raw -f npins/default.nix home-manager)
+nix_path="nixpkgs=${nixpkgs_pin}:nixgl=${nixgl_pin}:home-manager=${homemanager_pin}"
+
+# without --fast, nixos-rebuild will compile nix and use the compiled nix to
+# evaluate the config, wasting several seconds
+env NIX_PATH="${nix_path}" "${homemanager}" "$cmd" "$@"
diff --git a/npins/default.nix b/npins/default.nix
new file mode 100644
index 0000000..5e7d086
--- /dev/null
+++ b/npins/default.nix
@@ -0,0 +1,80 @@
+# Generated by npins. Do not modify; will be overwritten regularly
+let
+  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  version = data.version;
+
+  mkSource =
+    spec:
+    assert spec ? type;
+    let
+      path =
+        if spec.type == "Git" then
+          mkGitSource spec
+        else if spec.type == "GitRelease" then
+          mkGitSource spec
+        else if spec.type == "PyPi" then
+          mkPyPiSource spec
+        else if spec.type == "Channel" then
+          mkChannelSource spec
+        else
+          builtins.throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = path; };
+
+  mkGitSource =
+    {
+      repository,
+      revision,
+      url ? null,
+      hash,
+      branch ? null,
+      ...
+    }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null then
+      (builtins.fetchTarball {
+        inherit url;
+        sha256 = hash; # FIXME: check nix version & use SRI hashes
+      })
+    else
+      assert repository.type == "Git";
+      let
+        urlToName =
+          url: rev:
+          let
+            matched = builtins.match "^.*/([^/]*)(\\.git)?$" repository.url;
+
+            short = builtins.substring 0 7 rev;
+
+            appendShort = if (builtins.match "[a-f0-9]*" rev) != null then "-${short}" else "";
+          in
+          "${if matched == null then "source" else builtins.head matched}${appendShort}";
+        name = urlToName repository.url revision;
+      in
+      builtins.fetchGit {
+        url = repository.url;
+        rev = revision;
+        inherit name;
+        # hash = hash;
+      };
+
+  mkPyPiSource =
+    { url, hash, ... }:
+    builtins.fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource =
+    { url, hash, ... }:
+    builtins.fetchTarball {
+      inherit url;
+      sha256 = hash;
+    };
+in
+if version == 3 then
+  builtins.mapAttrs (_: mkSource) data.pins
+else
+  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
diff --git a/npins/sources.json b/npins/sources.json
new file mode 100644
index 0000000..3e024d6
--- /dev/null
+++ b/npins/sources.json
@@ -0,0 +1,35 @@
+{
+  "pins": {
+    "home-manager": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "home-manager"
+      },
+      "branch": "master",
+      "revision": "b3d5ea65d88d67d4ec578ed11d4d2d51e3de525e",
+      "url": "https://github.com/nix-community/home-manager/archive/b3d5ea65d88d67d4ec578ed11d4d2d51e3de525e.tar.gz",
+      "hash": "1l7wzwwlx1h0946l31apb939scb7xmcyywgs1jng7lzns49ca2cd"
+    },
+    "nixgl": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "guibou",
+        "repo": "nixGL"
+      },
+      "branch": "main",
+      "revision": "310f8e49a149e4c9ea52f1adf70cdc768ec53f8a",
+      "url": "https://github.com/guibou/nixGL/archive/310f8e49a149e4c9ea52f1adf70cdc768ec53f8a.tar.gz",
+      "hash": "1crnbv3mdx83xjwl2j63rwwl9qfgi2f1lr53zzjlby5lh50xjz4n"
+    },
+    "nixpkgs": {
+      "type": "Channel",
+      "name": "nixos-unstable",
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-24.11pre662544.cb9a96f23c49/nixexprs.tar.xz",
+      "hash": "1qsdh5fzk9bvv6md4x9q6yjbqp2vqii1xi88flmg1p67pk34kqhw"
+    }
+  },
+  "version": 3
+}
\ No newline at end of file
diff --git a/pinning.nix b/pinning.nix
new file mode 100644
index 0000000..4f2929a
--- /dev/null
+++ b/pinning.nix
@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+let sources = import ./npins;
+in {
+  # FIXME(24.05 or nixos-unstable): change following two rules to
+  #
+  # nixpkgs.flake.source = sources.nixpkgs;
+  #
+  # which does the exact same thing, using the same machinery as flake configs
+  # do as of 24.05.
+  nix.registry.nixpkgs.to = {
+    type = "path";
+    path = sources.nixpkgs;
+  };
+  nix.nixPath = ["nixpkgs=flake:nixpkgs"];
+}
+