In support of your argument; Look for example at the Dockerfile for the official Golang container. They pin exact sha256 hashes for each architecture, and the source release in case you're on an un-binary-released architecture.

Pin specific versions of your packages, coupled with caching and you're sitting pretty.