so freeze "pins" the currently installed version of a given package?

Yes, or you can pin to a particular version prefix, for example `pkg freeze unbound⊙1` would allow upgrades to `1.2.X` but not to `1.3`

nice, thank you