No. Android Enterprise does not currently support pinning a device to a specific OS version or holding an app at a specific version. The available controls delay updates, but all updates eventually install.
Device owners (fully managed and dedicated devices) have three options:
Freeze periods can suspend all OS updates for up to 90 days, with a mandatory 60-day gap between periods. This is the longest an organisation can hold a device on a specific OS version. Once the freeze expires, pending updates install.
Work profile (BYOD) devices are controlled by the end user. The organisation cannot set system update policies on personally-owned devices.
Google Play System Updates (Mainline modules) ignore all of these controls and install automatically regardless of any configured policy or freeze period. See Are GPSU managed by system update policies?
App updates offer similar delay-only controls:
You cannot install or hold a specific older app version through Managed Google Play. Only the latest available version can be installed. Google Play Store and Google Play Services updates cannot be paused at all.
On work profile devices, apps update simultaneously across both personal and work profiles since only one copy of the APK exists on the device.
Google is actively surveying the Android Enterprise community (April 2026) about demand for OS and app version pinning, including capabilities like targeting a specific major version, specifying a minimum security patch level, pinning exact app versions, and rolling back problematic updates. This suggests these features are under consideration but not yet available.
Until pinning is available, the practical approach is:
For broader guidance on managing major OS updates, see What happens when a managed device receives a major Android update?