nox installs are currently done with `session.install`. We should determine if this is safe, and if not, we should use hashed installs.