diff --git a/DEVELOPER.md b/DEVELOPER.md
new file mode 100644
index 00000000..78a01c7a
--- /dev/null
+++ b/DEVELOPER.md
@@ -0,0 +1,24 @@
+# Developing
+
+## Installing
+
+You will need to install `tox` like this:
+
+```
+python3 -m pip install --user tox
+```
+
+## Testing
+
+```
+tox -e pre-commit
+tox -e py36
+tox -e py37
+tox -e py38
+```
+
+## Update requirements in setup.cfg
+
+```
+tox -e py36-update-requirements
+```
diff --git a/README.md b/README.md
index 7486aba2..ac07a735 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@ Some out-of-the-box hooks for pre-commit.
 
 See also: https://github.com/pre-commit/pre-commit
 
+This is a fork of https://github.com/pre-commit/pre-commit-hooks modified for build reproducibility.
 
 ### Using pre-commit-hooks with pre-commit
 
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 00000000..e23bb5f4
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,2 @@
+ruamel.yaml>=0.15
+toml
diff --git a/setup.cfg b/setup.cfg
index 890d6295..b3376a99 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = pre_commit_hooks
-version = 4.0.1
+version = 4.0.1a0
 description = Some out-of-the-box hooks for pre-commit.
 long_description = file: README.md
 long_description_content_type = text/markdown
@@ -24,8 +24,9 @@ classifiers =
 [options]
 packages = find:
 install_requires =
-    ruamel.yaml>=0.15
-    toml
+    ruamel.yaml==0.17.16
+    ruamel.yaml.clib==0.2.6
+    toml==0.10.2
 python_requires = >=3.6.1
 
 [options.packages.find]
diff --git a/tox.ini b/tox.ini
index 390b56a0..3947d70c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py36,py37,py38,pypy3,pre-commit
+envlist = py36,py37,py38,pypy3,pre-commit,py36-update-requirements
 
 [testenv]
 deps = -rrequirements-dev.txt
@@ -10,7 +10,7 @@ setenv =
     GIT_COMMITTER_EMAIL = "test@example.com"
 commands =
     coverage erase
-    coverage run -m pytest {posargs:tests}
+    coverage run --source pre_commit_hooks -m pytest {posargs:tests}
     coverage report --fail-under 100
 
 [testenv:pre-commit]
@@ -18,6 +18,11 @@ skip_install = true
 deps = pre-commit
 commands = pre-commit run --all-files --show-diff-on-failure
 
+[testenv:py36-update-requirements]
+skip_install = true
+deps = -rrequirements.txt
+commands = python update_requirements.py
+
 [pep8]
 ignore=E265,E501,W504
 
diff --git a/update_requirements.py b/update_requirements.py
new file mode 100644
index 00000000..3b5775f4
--- /dev/null
+++ b/update_requirements.py
@@ -0,0 +1,37 @@
+import os
+import subprocess
+from configparser import ConfigParser
+
+print('*** Generate requirements.lock ***')
+subprocess.run('pip freeze >requirements.lock', shell=True, check=True)
+with open('requirements.lock') as f:
+    requirements = [
+        line for line in f.read().strip().splitlines()
+        if not line.startswith('pre-commit')
+    ]
+    print('\n'.join(requirements))
+
+os.remove('requirements.lock')
+print()
+
+# Read setup.cfg, replace install_requires value with requirements.lock, and
+# write setup.cfg
+parser = ConfigParser()
+parser.read('setup.cfg')
+requirements_str = ''.join(f'\n{requirement}' for requirement in requirements)
+parser.set('options', 'install_requires', requirements_str)
+with open('setup.cfg', 'w') as f:
+    parser.write(f)
+
+# Clean up setup.cfg
+with open('setup.cfg') as f:
+    setup_cfg = [
+        line.replace('\t', '    ').rstrip()
+        for line in f.read().splitlines()
+    ]
+
+
+with open('setup.cfg', 'w') as f:
+    f.write('\n'.join(setup_cfg))
+
+print('setup.cfg has been updated. Please commit this change')