How should I update a single input to a Nix flake?

I have a Nix flake with several inputs whose URLs are remote git repositories. I want to update one input in flake.lock, but not the others; in particular, I want to avoid repinning nixpkgs.

When I run nix flake update, all inputs are updated. This is probably desirable for correctness. However, I can subsequently roll back part of the changes to flake.lock, performing minor surgery, so that only one input is updated.

Is there a blessed or safe way to update only one input? I would accept a way to update a given input and all of its transitive dependencies, if that is the only safe way.

Unintuitively enough, you use a different command for that. nix flake update updates all inputs as you noticed, while you use
nix flake lock --update-input


to update only a single input. You can also chain several of these in a single command:
nix flake lock --update-input nixpkgs --update-input nix


StackExchange DevOps Q#18322, answer score: 4