diff --git a/core/core-packages.el b/core/core-packages.el
index 02c436f2b..2776f0984 100644
--- a/core/core-packages.el
+++ b/core/core-packages.el
@@ -68,7 +68,7 @@ package's name as a symbol, and whose CDR is the plist supplied to its
 `package!' declaration. Set by `doom-initialize-packages'.")
 
 (defvar doom-core-packages
-  '(persistent-soft quelpa use-package async)
+  '(persistent-soft use-package quelpa)
   "A list of packages that must be installed (and will be auto-installed if
 missing) and shouldn't be deleted.")
 
@@ -96,11 +96,18 @@ base by `doom!' and for calculating how many packages exist.")
       package-user-dir (expand-file-name "elpa" doom-packages-dir)
       package-enable-at-startup nil
       package-archives
-      '(("gnu"   . "https://elpa.gnu.org/packages/")
-        ("melpa" . "https://melpa.org/packages/"))
+      '(("gnu"          . "https://elpa.gnu.org/packages/")
+        ("melpa"        . "https://melpa.org/packages/")
+        ("melpa-stable" . "https://stable.melpa.org/packages/"))
       ;; I omit Marmalade because its packages are manually submitted rather
       ;; than pulled, so packages are often out of date with upstream.
 
+      ;; Don't gamble with these packages. Only retrieve stable versions. Quelpa
+      ;; is omitted because it isn't on melpa-stable.
+      package-pinned-packages
+      '((use-package     . "melpa-stable")
+        (persistent-soft . "melpa-stable"))
+
       ;; security settings
       gnutls-verify-error (not (getenv "INSECURE")) ; you shouldn't use this
       tls-checktrust gnutls-verify-error
diff --git a/core/packages.el b/core/packages.el
index 3a5004ed5..74721a286 100644
--- a/core/packages.el
+++ b/core/packages.el
@@ -4,6 +4,7 @@
 ;; core packages
 (package! s)
 (package! f)
+(package! async)
 
 ;; core-os.el
 ;; In case this config is shared across multiple computers (like mine is), let's