shell.nix: Use pinned nixpkgs from flake.lock

shell.nix

@@ -1,9 +1,21 @@
-{ pkgs ? import <nixpkgs> {
+{ pkgs ? (
-    overlays = [
+    let
-      (import ./overlay.nix)
+      inherit (builtins) fromJSON readFile;
-    ];
+      flakeLock = fromJSON (readFile ./flake.lock);
-  }
+      locked = flakeLock.nodes.nixpkgs.locked;
+      nixpkgs = assert locked.type == "github"; builtins.fetchTarball {
+        url = "https://github.com/${locked.owner}/${locked.repo}/archive/${locked.rev}.tar.gz";
+        sha256 = locked.narHash;
+      };
+    in
+    import nixpkgs {
+      overlays = [
+        (import ./overlay.nix)
+      ];
+    }
+  )
 }:
+
 let
   pythonEnv = pkgs.python3.withPackages (_: [ ]);