> but if you add or remove a dependency that version may shift around a bit as a part of dependency resolution

  cargo add crate@version

is completely deterministic