diff --git a/createrepo.py b/createrepo.py
index 4f975a2..42841e5 100644
--- a/createrepo.py
+++ b/createrepo.py
@@ -35,6 +35,14 @@
 import subprocess
 import glob
 import urllib.request
+import yaml
+
+
+try:
+    pins = yaml.safe_load(open("pins.yml"))
+except Exception as ex:
+    print("[WARNING] while parsing pins.yml:", ex, file=sys.stderr)
+    pins = {}
 
 def is_pngfile(file_path):
     kind = filetype.guess(file_path)
@@ -162,7 +170,7 @@ def is_pngfile(file_path):
             "testing": semver_tag.prerelease is not None,
             "labels": image_labels,
         }
-        print("* Add version", tag, file=sys.stderr)
+        print("* Add registry version", tag, file=sys.stderr)
         metadata["versions"].append(image_version)
 
         if semver_tag.prerelease is None:
@@ -171,6 +179,24 @@ def is_pngfile(file_path):
         else:
             testing_found = True
 
+    for tag in pins.get(entry_name, []):
+        semver_tag = semver.parse_version_info(tag)
+        try:
+            # Fetch the pinned image labels
+            with subprocess.Popen(["skopeo", "inspect", f'docker://{metadata["source"]}:{tag}'], stdout=subprocess.PIPE, stderr=sys.stderr) as proc:
+                image_inspect = json.load(proc.stdout)
+            image_labels = image_inspect['Labels']
+        except Exception as ex:
+            print(f'[ERROR] cannot inspect {metadata["source"]}:{tag}', ex, file=sys.stderr)
+            continue
+
+        image_version = {
+            "tag": tag,
+            "testing": semver_tag.prerelease is not None,
+            "labels": image_labels,
+        }
+        print("* Add pinned version", tag, file=sys.stderr)
+        metadata["versions"].append(image_version)
 
     if metadata["versions"]:
         index.append(metadata)
diff --git a/createrepo.sh b/createrepo.sh
index 67973f0..3532f02 100644
--- a/createrepo.sh
+++ b/createrepo.sh
@@ -27,7 +27,7 @@ if ! buildah containers --format "{{.ContainerName}}" | grep -q repomd-builder;
     buildah from --name repomd-builder -v "${PWD}:/usr/src:Z" docker.io/library/python:3.11-alpine
     buildah run repomd-builder sh <<EOF
 python3 -mvenv /opt/pyenv --upgrade-deps
-/opt/pyenv/bin/pip3 install semver==3.0.1 filetype
+/opt/pyenv/bin/pip3 install semver==3.0.1 filetype PyYAML
 apk add skopeo
 EOF
 fi
diff --git a/pins.yml b/pins.yml
new file mode 100644
index 0000000..a0b043a
--- /dev/null
+++ b/pins.yml
@@ -0,0 +1,7 @@
+---
+# Since the introduction of the labels `org.nethserver.min-core` and
+# `org.nethserver.min-from` in core 2.10, we can pin specific image tags
+# to ensure they are always visible to clients, allowing for gradual
+# upgrades between breaking releases.
+core:
+  - 2.9.5 # See #7040 #7047