I set this up a while back (and recently moved to Forgejo, see the update note at the beginning of the article):
Probably a tad overkill honestly but it works amazingly well, and turns every potential upgrade into an approval process so nothing will update when you don't want it to.