diff --git a/CHANGELOG.md b/CHANGELOG.md
index 432619ed..00340dd4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ IMPROVEMENTS:
 * cli: `registry list` command now shows git refs to repositories present in the cache [[GH-318](https://github.com/hashicorp/nomad-pack/pull/318)]
 * cli: `registry list` command now shows only registries, and a new command `list` shows packs [[GH-337](https://github.com/hashicorp/nomad-pack/pull/337)], [[GH-373](https://github.com/hashicorp/nomad-pack/pull/373)]
 * cli: `deps vendor` command [[GH-367](https://github.com/hashicorp/nomad-pack/pull/367)]
+* cli: `deps vendor` command now allows dependencies to be pinned [[GH-447](https://github.com/hashicorp/nomad-pack/pull/447)]
 * cli: `generate pack` command now supports `--overwrite` flag [[GH-380](https://github.com/hashicorp/nomad-pack/pull/380)]
 * cli: `registry add` command now uses shallow cloning [[GH-444](https://github.com/hashicorp/nomad-pack/pull/444)]
 * deps: Update the Nomad OpenAPI dependency; require Go 1.18 as a build dependency [[GH-288](https://github.com/hashicorp/nomad-pack/pull/288)]
diff --git a/internal/pkg/deps/vendor.go b/internal/pkg/deps/vendor.go
index d12e55bd..489fa626 100644
--- a/internal/pkg/deps/vendor.go
+++ b/internal/pkg/deps/vendor.go
@@ -32,10 +32,18 @@ func Vendor(ctx context.Context, ui terminal.UI, targetPath string) error {
 
 	for _, d := range metadata.Dependencies {
 		targetDir := path.Join(targetPath, "deps", d.Name)
+		url := d.Source
+
+		if !d.IsLatest() {
+			url = fmt.Sprintf("%s?ref=%s", url, d.Ref)
+		} else {
+			// Attempt to shallow clone the constructed url
+			url = fmt.Sprintf("%s?depth=1", url)
+		}
 
 		// download each dependency
 		ui.Info(fmt.Sprintf("downloading %v pack to %v...", d.Name, targetDir))
-		if err := gg.Get(targetDir, fmt.Sprintf(d.Source), gg.WithContext(ctx)); err != nil {
+		if err := gg.Get(targetDir, url, gg.WithContext(ctx)); err != nil {
 			return fmt.Errorf("error downloading dependency: %v", err)
 		}
 		ui.Success("...success!")
diff --git a/sdk/pack/dependency.go b/sdk/pack/dependency.go
index 32583689..6ca828b7 100644
--- a/sdk/pack/dependency.go
+++ b/sdk/pack/dependency.go
@@ -20,6 +20,10 @@ type Dependency struct {
 	// variable values.
 	Alias string `hcl:"alias,optional"`
 
+	// Ref is the git reference of the pack at which to add. Ignored if not
+	// specifying a git source. Defaults to latest.
+	Ref string `hcl:"ref,optional"`
+
 	// Source is the remote source where the pack can be fetched. This string
 	// can follow any format as supported by go-getter or be a local path
 	// indicating the pack has already been downloaded.
@@ -45,6 +49,11 @@ func (d *Dependency) ID() ID {
 	return ID(d.AliasOrName())
 }
 
+// IsLatest works out if the user requested the HEAD of the dependency
+func (d *Dependency) IsLatest() bool {
+	return d.Ref == "" || d.Ref == "latest"
+}
+
 // validate the Dependency object to ensure it meets requirements and doesn't
 // contain invalid or incorrect data.
 func (d *Dependency) validate() error {