Pin more modules from upstreams

In an effort to get a handle on unexpected failures.