diff --git a/data/helpers.d/apt b/data/helpers.d/apt
index aee022da7..8ba5bbe3e 100644
--- a/data/helpers.d/apt
+++ b/data/helpers.d/apt
@@ -283,7 +283,7 @@ ynh_install_app_dependencies () {
             if ! grep --recursive --quiet "^ *deb.*sury" /etc/apt/sources.list*
             then
                 # Re-add sury
-                ynh_install_extra_repo --repo="https://packages.sury.org/php/ $(ynh_get_debian_release) main" --key="https://packages.sury.org/php/apt.gpg" --name=extra_php_version --priority=600
+                ynh_add_sury
             fi
         fi
     fi
@@ -304,7 +304,24 @@ EOF
     ynh_app_setting_set --app=$app --key=apt_dependencies --value="$dependencies"
 }
 
+# Add sury repository with adequate pin strategy
+#
+# [internal]
+#
+# usage: ynh_add_sury
+#
+ynh_add_sury() {
 
+    # Add an extra repository for those packages
+    ynh_install_extra_repo --repo="https://packages.sury.org/php/ $(ynh_get_debian_release) main" --key="https://packages.sury.org/php/apt.gpg" --name=extra_php_version --priority=600
+
+    # Pin this extra repository after packages are installed to prevent sury of doing shit
+    for package_to_not_upgrade in "php" "php-fpm" "php-mysql" "php-xml" "php-zip" "php-mbstring" "php-ldap" "php-gd" "php-curl" "php-bz2" "php-json" "php-sqlite3" "php-intl" "openssl" "libssl1.1" "libssl-dev"
+    do
+        ynh_pin_repo --package="$package_to_not_upgrade" --pin="origin \"packages.sury.org\"" --priority="-1" --name=extra_php_version --append
+    done
+
+}
 
 
 # Add dependencies to install with ynh_install_app_dependencies
diff --git a/data/helpers.d/php b/data/helpers.d/php
index 7c91d89d2..6d47fdc13 100644
--- a/data/helpers.d/php
+++ b/data/helpers.d/php
@@ -348,8 +348,7 @@ ynh_install_php () {
         echo "$YNH_APP_INSTANCE_NAME:$phpversion" | tee --append "/etc/php/ynh_app_version"
     fi
 
-    # Add an extra repository for those packages
-    ynh_install_extra_repo --repo="https://packages.sury.org/php/ $(ynh_get_debian_release) main" --key="https://packages.sury.org/php/apt.gpg" --name=extra_php_version --priority=600
+    ynh_add_sury
 
     # Install requested dependencies from this extra repository.
     # Install PHP-FPM first, otherwise PHP will install apache as a dependency.