- name: make sure the `nginx` package is installed
  ansible.builtin.apt:
    name: nginx={{ nginx__version_spec }}*
    state: present
    allow_change_held_packages: true
    update_cache: true
  become: true

- name: apt-mark hold `nginx`
  ansible.builtin.dpkg_selections:
    name: nginx
    selection: hold
  become: true