diff --git a/apps/packages.nix b/apps/packages.nix
index 1b29e0e5..ee6c65fd 100644
--- a/apps/packages.nix
+++ b/apps/packages.nix
@@ -11,5 +11,6 @@ in
   listToAttrs (map (x: nameValuePair x (callPackage ./${x})) [
     "extract-subs"
     "gen-docs"
+    "pin-inputs"
     "update-sources"
   ])
diff --git a/apps/pin-inputs/.envrc b/apps/pin-inputs/.envrc
new file mode 100644
index 00000000..fd3dddda
--- /dev/null
+++ b/apps/pin-inputs/.envrc
@@ -0,0 +1,2 @@
+use flake $FLAKE#node
+npm ci
diff --git a/apps/pin-inputs/default.nix b/apps/pin-inputs/default.nix
new file mode 100644
index 00000000..1d6b1c75
--- /dev/null
+++ b/apps/pin-inputs/default.nix
@@ -0,0 +1,11 @@
+{buildApp, ...}:
+buildApp {
+  src = ./.;
+  npmDepsHash = "sha256-s4eh0nL52/bS/yIo2BQgdTN6l3SiD2NTY2KntxjpIl4=";
+
+  runtimeInputs = [];
+
+  meta.description = ''
+    Takes a list of inputs to pin to their current rev in `flake.lock`.
+  '';
+}
diff --git a/apps/pin-inputs/eslint.config.ts b/apps/pin-inputs/eslint.config.ts
new file mode 100644
index 00000000..7d0908f3
--- /dev/null
+++ b/apps/pin-inputs/eslint.config.ts
@@ -0,0 +1,3 @@
+import eslintConf from 'eslint-conf';
+
+export default eslintConf;
diff --git a/apps/pin-inputs/package-lock.json b/apps/pin-inputs/package-lock.json
new file mode 100644
index 00000000..9019d71a
Binary files /dev/null and b/apps/pin-inputs/package-lock.json differ
diff --git a/apps/pin-inputs/package.json b/apps/pin-inputs/package.json
new file mode 100644
index 00000000..fcd992cd
--- /dev/null
+++ b/apps/pin-inputs/package.json
@@ -0,0 +1,18 @@
+{
+    "name": "pin-inputs",
+    "version": "0.0.0",
+    "bin": "out/bin/app.cjs",
+    "type": "module",
+    "scripts": {
+        "build": "node_ver=$(node -v); esbuild src/app.ts --bundle --platform=node --target=\"node${node_ver:1:2}\" --outfile=out/bin/app.cjs"
+    },
+    "devDependencies": {
+        "eslint-conf": "file:../config",
+        "@types/node": "22.10.10",
+        "esbuild": "0.24.2",
+        "eslint": "9.19.0",
+        "jiti": "2.4.2",
+        "pkg-types": "1.3.1",
+        "typescript": "5.7.3"
+    }
+}
diff --git a/apps/pin-inputs/src/app.ts b/apps/pin-inputs/src/app.ts
new file mode 100644
index 00000000..629d5b1d
--- /dev/null
+++ b/apps/pin-inputs/src/app.ts
@@ -0,0 +1,60 @@
+import { readFileSync, writeFileSync } from 'fs';
+
+export const replaceInFile = (replace: RegExp, replacement: string, file: string) => {
+    const fileContents = readFileSync(file);
+
+    const replaced = fileContents.toString().replace(replace, replacement);
+
+    writeFileSync(file, replaced);
+};
+
+/* Constants */
+const FLAKE = process.env.FLAKE;
+
+if (!FLAKE) {
+    console.error('Environment variable FLAKE not found');
+    process.exit(1);
+}
+
+const FLAKE_LOCK = JSON.parse(readFileSync(`${FLAKE}/flake.lock`, 'utf8')).nodes;
+const INPUT_REVS = new Map<string, string>();
+
+Object.entries(FLAKE_LOCK).forEach(([key, val]) => {
+    if (key !== 'root') {
+        // eslint-disable-next-line
+        INPUT_REVS.set(key, (val as any).locked.rev);
+    }
+});
+
+const INPUTS = process.argv.slice(2);
+
+
+/**
+ * Gets the commit hash of the specified input in this flake.
+ *
+ * @param input the name of the input
+ * @returns the commit hash
+ */
+const getCurrentRev = (input: string): string => {
+    if (!INPUT_REVS.has(input)) {
+        throw new Error(`Input ${input} could not be found.`);
+    }
+
+    return INPUT_REVS.get(input) as string;
+};
+
+INPUTS.forEach((input) => {
+    try {
+        const inputsFile = `${FLAKE}/inputs/default.nix`;
+        const rev = getCurrentRev(input);
+
+        replaceInFile(
+            new RegExp(`(\\n[ ]*)${input} =.*\\n.*\\n.*`),
+            `$&\n$1  # FIXME: $1  rev = "${rev}";`,
+            inputsFile,
+        );
+    }
+    catch (e) {
+        console.error((e as Error).message);
+    }
+});
diff --git a/apps/pin-inputs/tsconfig.json b/apps/pin-inputs/tsconfig.json
new file mode 100644
index 00000000..763e4667
--- /dev/null
+++ b/apps/pin-inputs/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "extends": "../config/tsconfig.base.json",
+  "includes": [
+    "*.ts",
+    "**/*.ts",
+    "*.js",
+    "**/*.js"
+  ]
+}