diff --git a/.circleci/config.yml b/.circleci/config.yml
index bc94d6fd5440cf5a5ecee94c60329a3c64058437..782aaeb9bce52f9dcb8855261dd0b56fc75e1729 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -241,6 +241,16 @@ workflows:
         py-version: "39"
         tahoe-lafs-source: "tahoe-lafs"
 
+    - "linux-tests":
+        name: "Linux tests python 3.9, Tahoe-LAFS master"
+        py-version: "39"
+        # This is usually not master@HEAD because it is still pinned to a
+        # certain revision.  The intent is to update it frequently and
+        # discover fixable incompatibilities in small groups and unfixable
+        # incompatibilities early enough to prevent them from going into a
+        # release.
+        tahoe-lafs-source: "tahoe-lafs-master"
+
     # https://circleci.com/docs/2.0/testing-ios/#supported-xcode-versions
     - "macos-tests":
         name: "macOS tests python 3.8 xcode 11.7.0"
diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
index 3c8030a2583f5458fb102726a83a6be2d501c049..623c8a4cfc4fa7b2f88a34c6ccd3d02fe5a8426f 100644
--- a/CONTRIBUTING.rst
+++ b/CONTRIBUTING.rst
@@ -31,9 +31,9 @@ Python Dependencies
 ...................
 
 We use `mach-nix <https://github.com/DavHau/mach-nix/>`_ to build python packages.
-It uses a snapshot of pypi to expose python dependencies to nix,
+It uses a snapshot of PyPI to expose python dependencies to nix,
 thus our python depedencies (on nix) are automatically pinned.
-To update the pypy snapshot (and thus our python dependencies), run
+To update the PyPI snapshot (and thus our python dependencies), run
 
 .. code:: shell
 
@@ -42,14 +42,38 @@ To update the pypy snapshot (and thus our python dependencies), run
 tahoe-lafs
 ..........
 
-We depend on pinned commit of tahoe-lafs.
-To update to the latest commit, run
+ZKAPAuthorizer declares a dependency on Tahoe-LAFS with a narrow version range.
+This means that Tahoe-LAFS will be installed when ZKAPAuthorizer is installed.
+It also means that ZKAPAuthorizer exerts a great deal of control over the version of Tahoe-LAFS chosen.
+
+When installing using native Python packaging mechanisms
+(for example, pip)
+the relevant Tahoe-LAFS dependency declaration is in ``setup.cfg``.
+See the comments there about the narrow version constraint used.
+
+When installing the Nix package the version of Tahoe-LAFS is determined by the "tahoe-lafs" entry in the niv-managed ``nix/sources.json``.
+When feasible this is a released version of Tahoe-LAFS.
+To update to a new release, run:
+
+.. code:: shell
+
+   nix-shell --run 'niv update --rev tahoe-lafs-A.B.C tahoe-lafs'
+
+When it is not feasible to use a released version of Tahoe-LAFS,
+niv's ``--branch`` or ``--rev`` features can be used to update this dependency.
+
+It is also possible to pass a revision of ``pull/<pr-number>/head`` to test against a specific PR.
+
+We test against a pinned commit of Tahoe-LAFS master.
+To update to the current master@HEAD revision, run:
 
 .. code:: shell
 
-   nix-shell --run 'niv update tahoe-lafs --branch master'
+   nix-shell --run 'niv update tahoe-lafs-master --branch master'
 
-It is also possible to pass ``pull/<pr-number>/head`` to test against a specific PR.
+We intend for these updates to be performed periodically.
+At the moment, they must be performed manually.
+It might be worthwhile to `automate this process <https://github.com/PrivateStorageio/ZKAPAuthorizer/issues/287>` in the future.
 
 .. note::
 
@@ -57,7 +81,7 @@ It is also possible to pass ``pull/<pr-number>/head`` to test against a specific
    the packaging in ``default.nix`` includes a fake version number.
    This will need to be update manually at least when the minor version of tahoe-lafs changes.
 
-If you want to test multiple versions, you can add an additional source, pointing at other version
+If you want to test additional versions, you can add an additional source, pointing at other version.
 
 .. code:: shell
 
diff --git a/nix/sources.json b/nix/sources.json
index fee56665c6d1b33bd996147104cda9901abcf426..5e23721d3393d58299acef4677b15b68c33cef21 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -64,5 +64,17 @@
         "type": "tarball",
         "url": "https://github.com/tahoe-lafs/tahoe-lafs/archive/tahoe-lafs-1.17.1.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "tahoe-lafs-master": {
+        "branch": "master",
+        "description": "The Tahoe-LAFS decentralized secure filesystem.",
+        "homepage": "https://tahoe-lafs.org/",
+        "owner": "tahoe-lafs",
+        "repo": "tahoe-lafs",
+        "rev": "766a53b5208c03c45ca0a98e97eee76870276aa1",
+        "sha256": "16mvh5ypgv9a5vhjnc78jjf4v5yzyyz19af2vixrc4zqb0ikxrxa",
+        "type": "tarball",
+        "url": "https://github.com/tahoe-lafs/tahoe-lafs/archive/766a53b5208c03c45ca0a98e97eee76870276aa1.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }