the usual way of updating NixOS with flakes is to first execute the command

$ sudo nix flake update

from the directory containing flake.nix, which updates the flake.lock file responsible for the choice of package versions, and then to execute the command

$ sudo nixos-rebuild switch --flake .

which performs the actual configuration switch. sometimes you may just want some packages to stop updating either because they’re large or they take a lot of cpu cycles to compile and you don’t need them to be as up-to-date as possible. let’s suppose that we have a very simple flake.nix:

{
  description = "my flake";
  inputs = {
    nixpkgs = {
      url = "github:NixOS/nixpkgs/nixos-unstable";
    };
  };
  outputs = {self, nixpkgs, ...}: {
    nixosConfigurations = {
      hostname = nixpkgs.lib.nixosSystem {
        modules = [ ./configuration.nix ];
      };
    };
  };
}

and configuration.nix looks like this:

{ config, pkgs, ... }:

{
  imports =
    [ 
      ./hardware-configuration.nix
    ];
    
  # non-package-related stuff
  
  environment.systemPackages = with pkgs; [
  	package1
  	package2
  	package3
  ];
  
}

first, grab the commit hash, for example e72e4f299401a3689d4b3d5fc6496b11db7064eb. if you want packages to merely stop updating, grab it from the flake.lock file in the directory with flake.nix. if you want to downgrade, you’ll have to dig in the nixpkgs github repo. now we want the flake.nix to look like this:

{
  description = "my flake";
  inputs = {
    nixpkgs = {
      url = "github:NixOS/nixpkgs/nixos-unstable";
    };
    nixpkgs-e72e4f29 = {
      url = "github:NixOS/nixpkgs/e72e4f299401a3689d4b3d5fc6496b11db7064eb";
    };
  };
  outputs = {self, nixpkgs, nixpkgs-e72e4f29, ...}:
  {
    nixosConfigurations = {
      hostname = nixpkgs.lib.nixosSystem {
        specialArgs = let
          system = "x86_64-linux";
        in {
          pkgs-e72e4f29 = import nixpkgs-e72e4f29 {
            inherit system;
            config.allowUnfree = true;
          };
        };
        modules = [ ./configuration.nix ];
      };
    };
  };
}

note the specialArgs, which passes non-default arguments to submodules and is required here. now to lock a version of package3, we can use the following configuration.nix:

{ config, pkgs, pkgs-e72e4f29, ... }:

{
  imports =
    [ 
      ./hardware-configuration.nix
    ];
    
  # non-package-related stuff
  
  environment.systemPackages = (with pkgs; [
  	package1
  	package2
  	#package3
  ] ++ [
  	pkgs-e72e4f29.package3
  ]);
  
}

basically here you need to remember that with pkgs; [package1 package2 package3] is shorthand for [pkgs.package1 pkgs.package2 pkgs.package3] and [] ++ [] concatenates [] lists.

more reading: https://nixos-and-flakes.thiscute.world/nixos-with-flakes/downgrade-or-upgrade-packages