Holding package versions against automatic upgrades

A verified package version changes on the next apt upgrade, and behaviour changes with it.

The simplest lock:

apt-mark hold nginx
apt-mark showhold

Unhold to upgrade later.

Finer control with pinning in /etc/apt/preferences.d/nginx:

Package: nginx
Pin: version 1.24.*
Pin-Priority: 1001

Note that unattended-upgrades installs security updates only, and those can still change behaviour. Exclude specific packages in /etc/apt/apt.conf.d/50unattended-upgrades:

Unattended-Upgrade::Package-Blacklist {
    "nginx";
};

Holding versions is not a long-term strategy, but it moves the upgrade to a time you choose.