diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index a40c3cef40..e17472611f 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -40,6 +40,7 @@
 ./hack/make-rules/update.sh
 ./hack/make-rules/verify.sh
 ./hack/make-rules/vet.sh
+./hack/pin-dependency.sh
 ./hack/test-integration.sh
 ./hack/test-update-storage-objects.sh
 ./hack/update-generated-kms-dockerized.sh
diff --git a/hack/lint-dependencies.sh b/hack/lint-dependencies.sh
index 14dc196d12..49bb4409d3 100755
--- a/hack/lint-dependencies.sh
+++ b/hack/lint-dependencies.sh
@@ -56,7 +56,7 @@ unused=$(comm -23 \
 if [[ -n "${unused}" ]]; then
   echo ""
   echo "Pinned module versions that aren't actually used:"
-  echo "${unused}"
+  echo "${unused}" | xargs -L 1 echo 'GO111MODULE=on go mod edit -dropreplace'
 fi
 
 if [[ -n "${unused}${outdated}" ]]; then
diff --git a/hack/pin-dependency.sh b/hack/pin-dependency.sh
index 0dce81643f..c5c3fc1d79 100755
--- a/hack/pin-dependency.sh
+++ b/hack/pin-dependency.sh
@@ -91,5 +91,15 @@ echo "Resolved to ${dep}@${rev}"
 echo "Running: go mod edit -replace ${dep}=${dep}@${rev}"
 go mod edit -replace "${dep}=${dep}@${rev}"
 
+# Propagate pinned version to staging repos that also have that dependency
+for repo in $(ls staging/src/k8s.io | sort); do
+  pushd "staging/src/k8s.io/${repo}" >/dev/null 2>&1
+    if go mod edit -json | jq -e -r ".Require[] | select(.Path == \"${dep}\")" > /dev/null; then
+      go mod edit -require "${dep}@${rev}"
+      go mod edit -replace "${dep}=${dep}@${rev}"
+    fi
+  popd >/dev/null 2>&1
+done
+
 echo ""
 echo "Run hack/update-vendor.sh to rebuild the vendor directory"
diff --git a/hack/update-vendor.sh b/hack/update-vendor.sh
index 89340c46cd..6f4ee965d0 100755
--- a/hack/update-vendor.sh
+++ b/hack/update-vendor.sh
@@ -70,10 +70,19 @@ function ensure_require_replace_directives_for_all_dependencies() {
   cat "${require_json}" | jq -r '"-replace \(.Path)=\(.Path)@\(.Version)"'            | xargs -L 100 go mod edit -fmt
   cat "${replace_json}" | jq -r '"-replace \(.Old.Path)=\(.New.Path)@\(.New.Version)"'| xargs -L 100 go mod edit -fmt
 
-  # 2. Add explicit require directives for indirect dependencies
+  # 2. Propagate root replace/require directives into staging modules, in case we are downgrading, so they don't bump the root required version back up
+  for repo in $(ls staging/src/k8s.io); do
+    pushd "staging/src/k8s.io/${repo}" >/dev/null 2>&1
+      cat "${require_json}" | jq -r '"-require \(.Path)@\(.Version)"'                     | xargs -L 100 go mod edit -fmt
+      cat "${require_json}" | jq -r '"-replace \(.Path)=\(.Path)@\(.Version)"'            | xargs -L 100 go mod edit -fmt
+      cat "${replace_json}" | jq -r '"-replace \(.Old.Path)=\(.New.Path)@\(.New.Version)"'| xargs -L 100 go mod edit -fmt
+    popd >/dev/null 2>&1
+  done
+
+  # 3. Add explicit require directives for indirect dependencies
   go list -m -json all | jq -r 'select(.Main != true) | select(.Indirect == true) | "-require \(.Path)@\(.Version)"'          | xargs -L 100 go mod edit -fmt
 
-  # 3. Add explicit replace directives pinning dependencies that aren't pinned yet
+  # 4. Add explicit replace directives pinning dependencies that aren't pinned yet
   go list -m -json all | jq -r 'select(.Main != true) | select(.Replace == null)  | "-replace \(.Path)=\(.Path)@\(.Version)"' | xargs -L 100 go mod edit -fmt
 }