we're currently relying on pipenv to lock versions so we have consistent deployments.