diff --git a/tasks/install-repair-tools.yml b/tasks/install-repair-tools.yml
index eabc0ea124a8ef2381a8b57def8be5144a4180f6..0b3b6c77bdfa6cafb8b9f1281d66eefa60cf6d6d 100644
--- a/tasks/install-repair-tools.yml
+++ b/tasks/install-repair-tools.yml
@@ -59,7 +59,16 @@
     owner: "root"
     group: "root"
     mode: "750"
-  loop: "{{ tool_versions }}"
+  loop: "{{ tool_versions_local }}"
+
+- name: configure tool version pinning to avoid automatic nightly upgrades
+  ansible.builtin.template:
+    src: "etc/apt/preferences.d/pinning.j2"
+    dest: "/etc/apt/preferences.d/{{ item.package_name }}"
+    owner: "root"
+    group: "root"
+    mode: "750"
+  loop: "{{ tool_versions_public }}"
 
 # FHS 3.0 specifies the correct path for the config:
 # https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s09.html