Question: Is there are way to pin a system to a minor release, like 12.6?

Answer

Sometimes people will not want to upgrade Debian versions. I’m one of these people. I don’t track -updates on my stable boxes and only follow point releases. The only thing I do track is -security. In this answer I’m gonna go nuclear and show you how to pin Debian to one version, while still applying security upgrades.

In order not to upgrade without cause you probably have the following sources configured. Replace bookworm with your actual suite, e.g. trixie.

Types: deb
URIs: https://deb.debian.org/debian/
Suites: bookworm
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: https://security.debian.org/debian-security/
Suites: bookworm-security
Components: main  contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Now you create a file called /etc/apt/preferences.d/stable. In this file we are going to prioritize the 12.6 version and make every other version installable but not upgradable. It is very similar to how backports work, with the exception that you don’t get the upgrade for the packages.

Package: *
Pin: release v=12.6 o=Debian,n=bookworm
Pin-Priority: 1001

Package: *
Pin: release o=Debian,n=bookworm
Pin-Priority: 100

You will still get -security updates, as these are release v=12,o=Debian,n=bookworm-security.

Your 50unattended-upgrades would look something like this. It will use your current codename to stay up-to-date on just point-releases.

Unattended-Upgrade::Origins-Pattern {
  "origin=Debian,codename=${distro_codename},label=Debian";
  "origin=Debian,codename=${distro_codename},label=Debian-Security";
  "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
};

// Everything below this is optional, but it contains my configuration
Unattended-Upgrade::Package-Blacklist {
};

Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::InstallOnShutdown "false";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::SyslogEnable "true";
// Allow package downgrade if Pin-Priority exceeds 1000
Unattended-Upgrade::Allow-downgrade "true";

This means point-releases aren’t automatic, but need to be done manually. It does mean that if you install a package post point release you could be upgrading a bit more. That might be a good thing tho.

In order to upgrade you need to change /etc/apt/preferences.d/stable file to reflect the bump: release v=12.6 should become release v=12.7.

The most corporate way is to setup a Debian mirror that only syncs point release when you get the formal ok within the company. But that is an excersize I leave for the corporate reader.