How to Version Lock RPM Packages in Linux

A version lock stops the package manager from upgrading (or downgrading) a package, so a known-good version stays installed while the rest of the system updates. This guide shows how to lock, list and release packages with dnf on current RHEL-family systems, with notes for older yum systems, openSUSE and Debian or Ubuntu. It applies to a server you administer yourself, such as a VPS; on shared hosting the server's packages are managed for you.

1. When a version lock makes sense

Lock a specific package for a specific reason, write the reason down, and set a date to review it.

2. dnf: AlmaLinux, Rocky Linux, RHEL 8 and later

dnf is the package manager on every supported RHEL-family release. Locking needs the versionlock plugin:

sudo dnf install 'dnf-command(versionlock)'

That installs the right plugin package for your release (python3-dnf-plugin-versionlock on RHEL 8 to 10 and their rebuilds).

Lock a package

# Lock the version that is installed now
sudo dnf versionlock add nginx

# Lock a specific version (use the full name-version-release)
sudo dnf versionlock add mariadb-server-10.11.*

To find the exact version string first, run rpm -q nginx or dnf list --showduplicates nginx.

List locks

sudo dnf versionlock list

Each line shows a locked package pattern, for example nginx-1:1.26.3-1.el9.*.

Release a lock

sudo dnf versionlock delete nginx     # one package
sudo dnf versionlock clear            # every lock

Block a version instead of pinning one

If you only want to avoid one bad release but allow others, use exclude:

sudo dnf versionlock exclude nginx-1.27.0*

The locks are stored in /etc/dnf/plugins/versionlock.list, a plain text file you can review or keep in version control.

Fedora 41 and later

Fedora now ships DNF5, where versionlock is built in. The commands are the same (dnf versionlock add, list, delete, clear), so no plugin is needed.

3. Test before you rely on a lock

4. Locking a whole module stream

On RHEL 8 and 9, some software such as PHP, Node.js and some databases come as module streams. Enabling a stream (for example sudo dnf module enable nodejs:22) already keeps you on that major version while still allowing its security updates. That is often a better choice than pinning an exact package version. Module streams are being phased out in RHEL 10 in favour of separately named packages, so check your release's documentation.

5. yum on older systems

CentOS 7 and RHEL 7 use yum and have reached end of life, so they no longer receive public updates. If you still manage one, the plugin is yum-plugin-versionlock and the commands mirror dnf:

sudo yum install yum-plugin-versionlock
sudo yum versionlock add httpd
sudo yum versionlock list
sudo yum versionlock delete httpd

Plan a move to a supported release such as AlmaLinux or Rocky Linux; a lock is no substitute for security updates.

6. openSUSE and SUSE Linux Enterprise

zypper has locking built in:

sudo zypper addlock nginx        # lock
sudo zypper locks                # list
sudo zypper removelock nginx     # release

A zypper lock prevents the package from being installed, removed or changed at all, not only upgraded.

7. Debian and Ubuntu

These systems use apt rather than RPM, but the idea is the same:

sudo apt-mark hold nginx         # hold at the installed version
apt-mark showhold                # list held packages
sudo apt-mark unhold nginx       # release

For finer control, such as preferring one version from a specific repository, use an APT pin file under /etc/apt/preferences.d/.

8. Good practice

• Lock the smallest set. Lock the one package that matters, not everything it depends on, unless updates prove you must.
• Don't lock the kernel for long. Kernel updates carry important security fixes. If you need a specific kernel, set it as the default boot entry and keep the lock short.
• Review monthly. Run dnf versionlock list as part of routine maintenance and release locks you no longer need.
• Automated updates respect locks. Tools such as dnf-automatic skip locked packages, which is the point, but it also means those packages are never patched automatically.
• Snapshot before big changes. Take a snapshot or backup before releasing a long-standing lock and upgrading.

9. Running this on Domain India

Version locks are a server-admin tool. On Domain India shared hosting (cPanel, DirectAdmin, Webuzo) the server's packages are managed for every account on it, and you can't install or lock system packages; choose your PHP version in the control panel instead.

A Domain India VPS is self-managed with full root access, so you run dnf and manage locks yourself. The VPS page lists AlmaLinux and Rocky Linux among the operating systems offered, and VPS plans include automated snapshots, which are useful before you release a lock and upgrade. Prices on the card are live and exclude 18% GST.

Ready to run your own server? Compare VPS plans, or open a support ticket if you are unsure whether a VPS or shared hosting fits your project.