apt-mark hold doesn't pin versions — how it nearly removed OpenSSH across our fleet

apt-mark hold blocks upgrades, not removals. Forcing a downgrade against a held package can make apt remove its dependents — we found this when a routine update's failure was the only thing keeping OpenSSH installed.

Raccontata dadev.to