---
title: "Pin the tool and provider versions · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/pinned-provider-versions
updated: 2026-10-20
licence: "All rights reserved"
---

# Pin the tool and provider versions

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code)
- Rule: Pin the version of the tool and of every provider, and commit the provider lock file with hashes for every platform you run on.
- How: Set `required_version` and a `version` for each provider in `required_providers`. Commit `.terraform.lock.hcl`, and fill in hashes for Linux and the laptops' platforms with `providers lock`. In CI, run `init -lockfile=readonly`, so a changed provider stops the build. Let a bot such as Renovate open the upgrade pull requests, as in [automated dependency updates](https://agentwranglers.se/playbook/engineering/version-control-and-review/automated-dependency-updates). Pulumi programs commit their package lock file instead.
- Check: `git ls-files .terraform.lock.hcl` prints the file. `init -lockfile=readonly` passes in CI. The `terraform` block sets `required_version`, and every provider block names a version.

Example:

```hcl
terraform {
  required_version = "~> 1.11"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}
```

```sh
tofu providers lock -platform=linux_amd64 -platform=linux_arm64 -platform=darwin_arm64
git add .terraform.lock.hcl
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/pinned-provider-versions`.

- Previous: [Review the plan and apply only from CI](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/plan-in-review)
- Next: [Split state by environment and layer](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/split-state)
- [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code)