Pin by digest, not by tag
Tags move. Digests don't.
A tag like 2.16 can point at a different image tomorrow. A sha256 digest can't.
Pin the base image by digest and every collection by exact version in requirements.yml.
Upgrades become a deliberate change you can review and roll back.