diff --git a/pkgs/desktops/gnome-3/find-latest-version.py b/pkgs/desktops/gnome-3/find-latest-version.py
index b0359f79969..548cfa3411d 100644
--- a/pkgs/desktops/gnome-3/find-latest-version.py
+++ b/pkgs/desktops/gnome-3/find-latest-version.py
@@ -1,4 +1,5 @@
 import argparse
+import math
 import json
 import requests
 import sys
@@ -27,13 +28,19 @@ version_policies = {
     'none': no_policy,
 }
 
-def make_version_policy(version_predicate, selected):
-    return lambda version: version_predicate(version, selected)
+def make_version_policy(version_predicate, selected, upper_bound):
+    if not upper_bound:
+        upper_bound = [math.inf, math.inf]
+    else:
+        upper_bound = version_to_list(upper_bound)
+
+    return lambda version: version_predicate(version, selected) and version_to_list(version) < upper_bound
 
 parser = argparse.ArgumentParser(description='Find latest version for a GNOME package by crawling their release server.')
 parser.add_argument('package-name', help='Name of the directory in https://ftp.gnome.org/pub/GNOME/sources/ containing the package.')
 parser.add_argument('version-policy', help='Policy determining which versions are considered stable. For most GNOME packages, odd minor versions are unstable but there are exceptions.', choices=version_policies.keys(), nargs='?', default='odd-unstable')
 parser.add_argument('requested-release', help='Most of the time, we will want to update to stable version but sometimes it is useful to test.', choices=['stable', 'unstable'], nargs='?', default='stable')
+parser.add_argument('--upper-bound', dest='upper-bound', help='Only look for versions older than this one (useful for pinning dependencies).')
 
 
 if __name__ == '__main__':
@@ -41,8 +48,9 @@ if __name__ == '__main__':
 
     package_name = getattr(args, 'package-name')
     requested_release = getattr(args, 'requested-release')
+    upper_bound = getattr(args, 'upper-bound')
     version_predicate = version_policies[getattr(args, 'version-policy')]
-    version_policy = make_version_policy(version_predicate, requested_release)
+    version_policy = make_version_policy(version_predicate, requested_release, upper_bound)
 
     # The structure of cache.json: https://gitlab.gnome.org/Infrastructure/sysadmin-bin/blob/master/ftpadmin#L762
     cache = json.loads(requests.get('https://ftp.gnome.org/pub/GNOME/sources/{}/cache.json'.format(package_name)).text)
diff --git a/pkgs/desktops/gnome-3/update.nix b/pkgs/desktops/gnome-3/update.nix
index f42b6723950..555504086a4 100644
--- a/pkgs/desktops/gnome-3/update.nix
+++ b/pkgs/desktops/gnome-3/update.nix
@@ -1,8 +1,18 @@
-{ stdenv, lib, writeScript, python3, common-updater-scripts }:
-{ packageName, attrPath ? packageName, versionPolicy ? "odd-unstable" }:
+{ stdenv, pkgs, lib, writeScript, python3, common-updater-scripts }:
+{ packageName, attrPath ? packageName, versionPolicy ? "odd-unstable", freeze ? false }:
 
 let
   python = python3.withPackages (p: [ p.requests ]);
+  upperBoundFlag =
+    let
+      package = lib.getAttrFromPath (lib.splitString "." attrPath) pkgs;
+      packageVersion = lib.getVersion package;
+      versionComponents = lib.versions.splitVersion packageVersion;
+      minorVersion = lib.versions.minor packageVersion;
+      minorAvailable = builtins.length versionComponents > 1 && builtins.match "[0-9]+" minorVersion != null;
+      nextMinor = builtins.fromJSON minorVersion + 1;
+      upperBound = "${lib.versions.major packageVersion}.${builtins.toString nextMinor}";
+    in lib.optionalString (minorAvailable && freeze) ''--upper-bound="${upperBound}"'';
   updateScript = writeScript "gnome-update-script" ''
     #!${stdenv.shell}
     set -o errexit
@@ -10,7 +20,7 @@ let
     attr_path="$2"
     version_policy="$3"
     PATH=${lib.makeBinPath [ common-updater-scripts python ]}
-    latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable")
+    latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable" ${upperBoundFlag})
     update-source-version "$attr_path" "$latest_tag"
   '';
 in [ updateScript packageName attrPath versionPolicy ]