diff --git a/versions.yaml b/versions.yaml
index 611b66cecf..7ad5a91228 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -246,8 +246,15 @@ externals:
   nvrc:
     # yamllint disable-line rule:line-length
     desc: "The NVRC project provides a Rust binary that implements a simple init system for microVMs"
-    version: "v0.1.4"
+    version: ""
     url: "https://github.com/NVIDIA/nvrc/releases/download/"
+    # While the composable-image work is in flight NVRC is built from source at
+    # a pinned git reference (tools/packaging/static-build/nvrc) instead of
+    # downloading the signed release from `url` above. `ref` may be a commit,
+    # tag or branch; pin to a commit for reproducible builds.
+    repo: "https://github.com/fidencio/nvrc.git"
+    ref: "668f01692142e24f6785d0cdd9f65c40aec28522"
+    toolchain: "1.94.0"
 
   nvidia:
     desc: "NVIDIA compute stack"