"Version lockfiles" for Alpine apk - alpine-linux

Question

I'm using Alpine Linux 3.7 in a Docker container.
I'm performing some apk commands inside a Dockerfile.
I have successfully pinned my dependencies to a particular major version:
apk add --no-cache \
'openssl<2' \
'freeradius<4' \
'freeradius-mysql<4'
But the exact behaviour of this command is sensitive to when the apk add command is run (i.e. when the Docker image is built).
At the time of writing, these constraints resolve to:
apk add --no-cache \
'openssl=1.0.2m-r0' \
'freeradius=3.0.15-r3' \
'freeradius-mysql=3.0.15-r3'
If I run apk add 'dep<majver' next year, probably I will get different results.
I don't want my dependencies to change version without my knowing.
Yes, not even minor version. I do not trust semver 100% to keep me safe from breaking changes / regressions, so changing minor version should be done under supervision only.
I don't want to hand-write the exact version resolutions (dep=ver). 'dep<majver' is preferred.
Package managers such as npm and yarn have a nice solution to this. Version lockfiles.
You'd have two documents under version control:
One manually-created document to express 'dep<majver'
One version lockfile, expressing (for each dependency) a specific dep=ver resolution which fulfils all your constraints.
This would be machine-generated. You would regenerate it deliberately, only when you want to update your every dependency to the latest version that satisfies your 'dep<majver' constraints.
Is there some kind of Alpine apk concept that fulfils the role of a "version lockfile"?
There is an obvious Docker solution: do the apk add 'dep<majver' step in a separate Dockerfile. Use that Dockerfile as a base image. Only rebuild that base Docker image when you're ready to bump your dependencies.
But I'm curious as to whether there's an Alpine apk solution, since this can be viewed as a package-management concern, not a provisioning concern.