I generally just use latest for most services. For critical stuff I pin the major version number. Also anything that doesn’t gracefully handle major version updates like Postgres and similar.