diff --git a/README.md b/README.md
index 022f3c2..25f5e19 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@ dehydrated_version | Which version to check out from github | HEAD
 dehydrated_challengetype | Challenge to use (http-01, dns-01) | http-01
 dehydrated_use_lexicon | Enable the use of lexicon | yes if dehydrated_challengetype == dns-01 else no
 dehydrated_lexicon_dns | Options for running lexicon | {}
+dehydrated_lexicon_dns_version | specific version of `dns-lexicon` to install | {} (== latest)
 dehydrated_hooks | Dict with hook-names for which to add scripts |
 dehydrated_hook_scripts | Add additional scripts to hooks-Directory | []
 dehydrated_key_algo | Keytype to generate (rsa, prime256v1, secp384r1) | rsa
diff --git a/defaults/main.yml b/defaults/main.yml
index 93f0efc..b74436c 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -9,6 +9,7 @@ dehydrated_update: yes
 dehydrated_version: HEAD
 dehydrated_challengetype: http-01
 dehydrated_lexicon_dns: {}
+#dehydrated_lexicon_dns_version: undefined # == latest
 dehydrated_key_algo: rsa
 dehydrated_keysize: 4096
 dehydrated_ca: "https://acme-v02.api.letsencrypt.org/directory"
diff --git a/tasks/dns-01-lexicon.yml b/tasks/dns-01-lexicon.yml
index d78a8ef..ce79816 100644
--- a/tasks/dns-01-lexicon.yml
+++ b/tasks/dns-01-lexicon.yml
@@ -7,6 +7,8 @@
 - name: Install dns-lexicon
   pip:
     name: dns-lexicon
+    version: "{{ dehydrated_lexicon_dns_version | d(omit) }}"
+    state: "{{ 'latest' if dehydrated_lexicon_dns_version is not defined else omit }}"
     executable: "{{ dehydrated_pip_executable|default(omit) }}"
 
 - name: Copy hook script