diff --git a/tljh/installer.py b/tljh/installer.py
index b64390d..d8b8b63 100644
--- a/tljh/installer.py
+++ b/tljh/installer.py
@@ -272,22 +272,10 @@ def ensure_user_environment(user_requirements_txt_file):
         'conda==' + conda_version
     ])
 
-    conda.ensure_pip_packages(USER_ENV_PREFIX, [
-        # JupyterHub + notebook package are base requirements for user environment
-        'jupyterhub==1.0.0',
-        'notebook==5.7.8',
-        # Install additional notebook frontends!
-        'jupyterlab==1.2.6',
-        'nteract-on-jupyter==2.0.7',
-        # nbgitpuller for easily pulling in Git repositories
-        'nbgitpuller==0.6.1',
-        # nbresuse to show people how much RAM they are using
-        'nbresuse==0.3.0',
-        # Most people consider ipywidgets to be part of the core notebook experience
-        'ipywidgets==7.4.2',
-        # Pin tornado
-        'tornado<6.0',
-    ])
+    conda.ensure_pip_requirements(
+        USER_ENV_PREFIX,
+        os.path.join(HERE, 'requirements-base.txt'),
+    )
 
     if user_requirements_txt_file:
         # FIXME: This currently fails hard, should fail soft and not abort installer
diff --git a/tljh/requirements-base.txt b/tljh/requirements-base.txt
new file mode 100644
index 0000000..ac3454a
--- /dev/null
+++ b/tljh/requirements-base.txt
@@ -0,0 +1,17 @@
+# FIXME: a frozen version of this file should be used
+# pinning only direct dependencies is a recipe for broken environments!
+
+# JupyterHub + notebook package are base requirements for user environment
+jupyterhub==1.0.*
+notebook==6.0.*
+# Install additional notebook frontends!
+jupyterlab==1.1.*
+nteract-on-jupyter==2.1.*
+# nbgitpuller for easily pulling in Git repositories
+nbgitpuller==0.7.*
+# nbresuse to show people how much RAM they are using
+nbresuse==0.3.*
+# Most people consider ipywidgets to be part of the core notebook experience
+ipywidgets==7.5.*
+# Pin tornado
+tornado<6