diff --git a/packages/projects.nix b/packages/projects.nix
index 051bba2..b27ac53 100644
--- a/packages/projects.nix
+++ b/packages/projects.nix
@@ -2,6 +2,7 @@
 let
   inherit (pkgs) lib;
   inherit (inputs) unstable;
+  inherit (inputs.self.packages.${system}) nix-super;
 
   pins = import ./sources;
 
@@ -48,9 +49,7 @@ in
 
     ipfs = pkgs.callPackage ./networking/ipfs { };
 
-    npins = let
-      inherit (inputs.self.packages.${system}) nix-super;
-    in pkgs.callPackage ./tools/npins {
+    npins = pkgs.callPackage ./tools/npins {
       nix = nix-super;
       nix-prefetch-git = pkgs.nix-prefetch-git.override {
         nix = nix-super;
@@ -59,6 +58,11 @@ in
 
     opentelemetry-java-agent-bin = pkgs.callPackage ./monitoring/opentelemetry-java-agent-bin { };
 
+    pin = pkgs.callPackage ./tools/pin {
+      inherit npins;
+      nix = nix-super;
+    };
+
     privatevoid-smart-card-ca-bundle = pkgs.callPackage ./data/privatevoid-smart-card-certificate-authority-bundle.nix { };
 
     reflex-cache = poetry2nix.mkPoetryApplication {
diff --git a/packages/tools/pin/default.nix b/packages/tools/pin/default.nix
new file mode 100644
index 0000000..380793c
--- /dev/null
+++ b/packages/tools/pin/default.nix
@@ -0,0 +1,13 @@
+{
+  writeShellApplication,
+  nix, npins
+}:
+
+writeShellApplication {
+  name = "pin";
+  runtimeInputs = [
+    nix
+    npins
+  ];
+  text = builtins.readFile ./pin.sh;
+}
diff --git a/packages/tools/pin/pin.sh b/packages/tools/pin/pin.sh
new file mode 100644
index 0000000..85782c4
--- /dev/null
+++ b/packages/tools/pin/pin.sh
@@ -0,0 +1,17 @@
+REPO_ROOT="${REPO_ROOT:-.}"
+NPINS_DIRECTORY="${NPINS_DIRECTORY:-npins}"
+
+cmd="$1"
+shift
+case $cmd in
+  update)
+    for pkg in "$@"; do
+      oldver=$(nix eval --raw "${REPO_ROOT}#${pkg}.version")
+      npins update "$pkg"
+      newver=$(nix eval --raw "${REPO_ROOT}#${pkg}.version")
+      git add "${NPINS_DIRECTORY}"
+      git commit "${NPINS_DIRECTORY}" -m "packages/$pkg: $oldver -> $newver"
+    done;;
+  *)
+    echo Unknown command: "$cmd";;
+esac
\ No newline at end of file