How to Use the winget pin Command in Windows 11 to Pin Packages and Block Unwanted Updates

The Windows Package Manager (winget) simplifies software management in Windows 11, enabling users to update all installed desktop applications simultaneously with a single winget upgrade --all command. However, automatic batch upgrades can occasionally introduce breaking changes, disrupt customized configurations, or install unstable major releases for critical development runtimes (such as Node.js, Python, or specialized database tools). To prevent specific software from updating automatically while allowing the rest of your system to stay current, winget includes the pin subcommand.

Understanding Winget Pinning Types: Pin vs Block vs Gating

The winget pin command supports three distinct operational pinning modes:

• Pin (Default): Excludes the package from batch winget upgrade --all executions. However, the package can still be upgraded explicitly if you target it directly by ID (e.g., winget upgrade --id Git.Git).
• Block: Completely prohibits the package from being updated by winget under any circumstances—even when targeted directly—until the block pin is removed.
• Gating (Version Pinning): Locks the application to a specific major or minor release branch (such as 18.*), permitting patch updates within the release family while blocking breaking major upgrades.

Listing Active Package Pins

To inspect all currently active package pins and constraints configured on your Windows 11 system, execute:

winget pin list

If pins are active, winget outputs a table detailing the Package Name, Package ID, Pin Type, and the Version boundary assigned to each entry.

Pinning an Application to Skip Batch Upgrades

To exempt an application from global winget upgrade --all scans while preserving the ability to update it manually, add a standard pin using its Package ID:

winget pin add --id VideoLAN.VLC

When you subsequently execute winget upgrade, VLC is omitted from the pending upgrade list, preventing unintended modifications.

Blocking Package Upgrades Completely

If you manage mission-critical utilities or enterprise-tested binaries where updates must be strictly prohibited, apply a blocking pin using the --blocking flag:

winget pin add --id OpenJS.NodeJS.LTS --blocking

If an administrator or automated script attempts to execute winget upgrade --id OpenJS.NodeJS.LTS, the command aborts with an error indicating that a blocking pin prevents installation.

Gating Package Updates to a Specific Version Family

For applications where minor security patches are welcomed but major interface overhauls or API deprecations must be avoided, use version gating with the --version parameter and wildcard notation:

winget pin add --id Python.Python.3.11 --version 3.11.*

Winget will update Python within the 3.11 maintenance branch (e.g., updating 3.11.8 to 3.11.9) but will refuse upgrades to Python 3.12 or higher.

Removing Package Pins

When you are ready to resume normal software upgrades or migrate to the latest release:

To remove a specific package pin by ID:

winget pin remove --id VideoLAN.VLC

To remove a specific version pin constraint:

winget pin remove --id Python.Python.3.11

To clear all package pins across the entire system simultaneously:

winget pin reset

Bypassing Pins During Manual Executions

If you want to run a global batch upgrade that includes pinned packages without permanently deleting your pin configurations, pass the --include-pinned parameter:

winget upgrade --all --include-pinned

This tells winget to temporarily bypass non-blocking pins for that single command execution.

Essential winget pin Syntax Reference

Command	Operation Performed
winget pin list	Displays all active package pins, types, and version gates.
winget pin add --id [ID]	Excludes package from upgrade --all batch operations.
winget pin add --id [ID] --blocking	Completely blocks all updates for the targeted package.
winget pin add --id [ID] --version [Pattern]	Gates package updates to a specific version or wildcard branch.
winget pin remove --id [ID]	Deletes the pin rule for the specified application.
winget pin reset	Purges all active package pins across the workstation.