diff --git a/.ci/flutter_master.version b/.ci/flutter_master.version
new file mode 100644
index 0000000..39e290b
--- /dev/null
+++ b/.ci/flutter_master.version
@@ -0,0 +1 @@
+3e6e996f9eff50d77214d37c1c5f8b71bcc0d559
diff --git a/.cirrus.yml b/.cirrus.yml
index bbaa39e..f2372a9 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -15,15 +15,25 @@
 
 flutter_upgrade_template: &FLUTTER_UPGRADE_TEMPLATE
   upgrade_flutter_script:
+    # Master uses a pinned, auto-rolled version to prevent out-of-band CI
+    # failures due to changes in Flutter.
+    # TODO(stuartmorgan): Investigate an autoroller for stable as well.
+    - TARGET_TREEISH=$CHANNEL
+    - if [[ "$CHANNEL" == "master" ]]; then
+    -   TARGET_TREEISH=$(< .ci/flutter_$CHANNEL.version)
+    - fi
     # Ensure that the repository has all the branches.
     - cd $FLUTTER_HOME
     - git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*"
     - git fetch origin
-    # Switch to the requested branch.
-    - git checkout $CHANNEL
-    # Reset to upstream branch, rather than using pull, since the base image
-    # can sometimes be in a state where it has diverged from upstream (!).
-    - git reset --hard @{u}
+    # Switch to the requested channel.
+    - git checkout $TARGET_TREEISH
+    # When using a branch rather than a hash, reset to the upstream branch
+    # rather than using pull, since the base image can sometimes be in a state
+    # where it has diverged from upstream (!).
+    - if [[ "$TARGET_TREEISH" == "$CHANNEL" ]]; then
+    -   git reset --hard @{u}
+    - fi
     # Run doctor to allow auditing of what version of Flutter the run is using.
     - flutter doctor -v
   << : *TOOL_SETUP_TEMPLATE