diff --git a/internal/creator/templates/pack_metadata.hcl b/internal/creator/templates/pack_metadata.hcl
index b255d20f..36e382a9 100644
--- a/internal/creator/templates/pack_metadata.hcl
+++ b/internal/creator/templates/pack_metadata.hcl
@@ -11,5 +11,5 @@ pack {
 
 // dependency "demo_dep" {
 //   alias  = "demo_dep"
-//   source = "git://source.git/packs/demo_dependency_pack"
+//   source = "git://source.git//packs/demo_dependency_pack"
 // }
diff --git a/internal/pkg/deps/vendor.go b/internal/pkg/deps/vendor.go
index d12e55bd..489fa626 100644
--- a/internal/pkg/deps/vendor.go
+++ b/internal/pkg/deps/vendor.go
@@ -32,10 +32,18 @@ func Vendor(ctx context.Context, ui terminal.UI, targetPath string) error {
 
 	for _, d := range metadata.Dependencies {
 		targetDir := path.Join(targetPath, "deps", d.Name)
+		url := d.Source
+
+		if !d.IsLatest() {
+			url = fmt.Sprintf("%s?ref=%s", url, d.Ref)
+		} else {
+			// Attempt to shallow clone the constructed url
+			url = fmt.Sprintf("%s?depth=1", url)
+		}
 
 		// download each dependency
 		ui.Info(fmt.Sprintf("downloading %v pack to %v...", d.Name, targetDir))
-		if err := gg.Get(targetDir, fmt.Sprintf(d.Source), gg.WithContext(ctx)); err != nil {
+		if err := gg.Get(targetDir, url, gg.WithContext(ctx)); err != nil {
 			return fmt.Errorf("error downloading dependency: %v", err)
 		}
 		ui.Success("...success!")
diff --git a/sdk/pack/dependency.go b/sdk/pack/dependency.go
index 32583689..6ca828b7 100644
--- a/sdk/pack/dependency.go
+++ b/sdk/pack/dependency.go
@@ -20,6 +20,10 @@ type Dependency struct {
 	// variable values.
 	Alias string `hcl:"alias,optional"`
 
+	// Ref is the git reference of the pack at which to add. Ignored if not
+	// specifying a git source. Defaults to latest.
+	Ref string `hcl:"ref,optional"`
+
 	// Source is the remote source where the pack can be fetched. This string
 	// can follow any format as supported by go-getter or be a local path
 	// indicating the pack has already been downloaded.
@@ -45,6 +49,11 @@ func (d *Dependency) ID() ID {
 	return ID(d.AliasOrName())
 }
 
+// IsLatest works out if the user requested the HEAD of the dependency
+func (d *Dependency) IsLatest() bool {
+	return d.Ref == "" || d.Ref == "latest"
+}
+
 // validate the Dependency object to ensure it meets requirements and doesn't
 // contain invalid or incorrect data.
 func (d *Dependency) validate() error {