How to Pin Applications in Windows 11 Using winget to Prevent Unintended Updates

The Windows Package Manager (winget) provides an efficient way to keep all installed desktop software up to date using a single command: winget upgrade --all. However, blind batch updating introduces operational risks: an unexpected major version update can break legacy project dependencies, introduce incompatible configuration formats, or alter user interfaces in production environments. For instance, developers frequently need to lock specific versions of runtime environments (like Node.js LTS, Python, or Java JDK) or preserve legacy utility releases. To prevent automated upgrades from overwriting critical packages, Microsoft introduced the winget pin management system in Windows 11.

What Is winget Pinning and How Does It Function?

Pinning in Windows Package Manager acts as an administrative lock on package manifests:

• Pinning Specific Versions: Locks an application strictly to its currently installed version, preventing any upgrades.
• Pinning Version Ranges (Prefix Pinning): Allows minor bugfix and security patch updates (e.g. 20.1.*) while blocking disruptive major version upgrades (e.g. upgrading from 20.x to 21.x).
• Blocking from Automated Upgrades: Excludes pinned software from winget upgrade --all invocations while still allowing manual, deliberate updates when requested.
• Transparent Auditing: View all currently active package pins, their constraints, and pinned versions in a clean tabular report.

Prerequisites

The pin command is included natively in modern releases of Windows Package Manager (winget v1.4 or higher). Verify that your winget client supports pinning by running in Windows Terminal:

winget pin --help

Step 1: Freezing an Application to its Exact Current Version

To completely lock an installed program so that winget never upgrades it during bulk update operations:

1. Open Windows Terminal (PowerShell or Command Prompt).
2. Find the exact PackageIdentifier using winget list:

   winget list "Node.js"

3. Execute the pin command using the package ID:

   winget pin add --id OpenJS.NodeJS.LTS

4. winget confirms: Successfully added pin for: OpenJS.NodeJS.LTS.

Whenever you run winget upgrade --all in the future, winget will check dependencies, note the active pin, and skip updating Node.js.

Step 2: Pinning a Major Version Range (Allowing Minor Patches)

In many enterprise development scenarios, you want to receive minor security patches within a stable branch while preventing major version jumps. Use the --version switch with wildcards:

winget pin add --id Python.Python.3.11 --version "3.11.*"

Under this configuration, winget will happily upgrade from 3.11.8 to 3.11.9, but will strictly refuse to upgrade the package to Python 3.12.

Step 3: Blocking an App from Bulk Upgrades (Gated Pinning)

If you want winget to exclude an application from bulk automated scripts (winget upgrade --all) but still permit updating when you explicitly target the specific package (winget upgrade --id AppName), use the --blocking flag:

winget pin add --id 7zip.7zip --blocking

Auditing and Listing Active Pins

To review all currently pinned software across your Windows 11 system, execute:

winget pin list

Windows outputs a structured table detailing:

Name	Id	Version	Pin type
Node.js LTS	OpenJS.NodeJS.LTS	20.12.0	Pinning
Python 3.11	Python.Python.3.11	3.11.*	Pinning
7-Zip	7zip.7zip	*	Blocking

How to Remove a Pin and Resume Normal Updates

When you are ready to migrate an application to a newer major release:

1. Execute the remove command specifying the target package ID:

   winget pin remove --id OpenJS.NodeJS.LTS

2. winget confirms: Successfully removed pin for: OpenJS.NodeJS.LTS.
3. You can now update the application normally:

   winget upgrade --id OpenJS.NodeJS.LTS

Utilizing winget pin provides the perfect balance between automated system maintenance and strict configuration stability in Windows 11.