Airflow provides a constraints file with the exact versions used. Here is how we can make the installation (almost) reproducible by relying on the hashes.
requirements.in
holds the dependencies with constraints.
# airflow and constraints
apache-airflow[celery]==2.9.0
-c https://raw.githubusercontent.com/apache/airflow/constraints-2.9.0/constraints-3.8.txt