diff --git a/sources/packages.txt b/sources/packages.txt
new file mode 100644
index 0000000..081246f
--- /dev/null
+++ b/sources/packages.txt
@@ -0,0 +1,6 @@
+cargo-llvm-cov
+cargo-nextest
+cargo-release
+cargo-udeps
+cargo-audit
+cargo-deny
diff --git a/sources/sources.json b/sources/sources.json
new file mode 100644
index 0000000..6896fa3
--- /dev/null
+++ b/sources/sources.json
@@ -0,0 +1,32 @@
+[
+  {
+    "hash": "sha256-ICNcBqlkX1k3J5vc/bfoXw/+l2LdHOchv4PfY0G7Y94=",
+    "pname": "cargo-audit",
+    "version": "0.17.6"
+  },
+  {
+    "hash": "sha256-/2HClc4rzQvvbmWXOotZuC9MEPPnPZKWCOVC2AadtG4=",
+    "pname": "cargo-deny",
+    "version": "0.13.9"
+  },
+  {
+    "hash": "sha256-5xHDjNFQDmi+SnhxfoCxoBdCqHpZEk/87r2sBKsT+W4=",
+    "pname": "cargo-llvm-cov",
+    "version": "0.5.19"
+  },
+  {
+    "hash": "sha256-IY8H9TnOBj0nAn8G1o8onN5kWAhJxkiBhU9jQ0/pIss=",
+    "pname": "cargo-nextest",
+    "version": "0.9.52"
+  },
+  {
+    "hash": "sha256-tmyIQMjKs37ZVqG/WV4Qe99Jc+bzneTmEMrvxV1Gnsc=",
+    "pname": "cargo-release",
+    "version": "0.24.10"
+  },
+  {
+    "hash": "sha256-jvEhE/fngzEzRinA4iZYJbBfcl2CGbTwQB52h5laVf8=",
+    "pname": "cargo-udeps",
+    "version": "0.1.39"
+  }
+]
diff --git a/sources/update-sources.sh b/sources/update-sources.sh
new file mode 100755
index 0000000..a2d0c18
--- /dev/null
+++ b/sources/update-sources.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -eou pipefail
+
+DIRECTORY=$(dirname "$0")
+PACKAGES_FILE="$DIRECTORY/packages.txt"
+SOURCES_FILE="$DIRECTORY/sources.json"
+
+TEMP_DIR=$(mktemp -d "rust-flake-sources.XXXX" -p $XDG_RUNTIME_DIR)
+pushd $TEMP_DIR
+
+echo ""
+for package in $(cat "$PACKAGES_FILE")
+do
+  version=$(curl -s "https://crates.io/api/v1/crates/$package" | jq ".crate.max_stable_version" | tr -d '"') 
+  echo "Fetching $package -- $version"
+  nurl "https://crates.io/crates/$package" "$version" -j | jq ".args" > $package.json
+  echo ""
+done
+
+popd
+jq -s "." $TEMP_DIR/* > $SOURCES_FILE
+rm -r $TEMP_DIR