You might want to check out straight.el [0] in replacement of package.el; it can pin package versions, etc. It is used by the very popular Doom Emacs [1] to lock package versions for reproducible config reasons.

[0] https://github.com/raxod502/straight.el [1] https://github.com/hlissner/doom-emacs