Is it possible to have lock files (or similar) for VS Code extensions?

I am distributing internal use devcontainers, and wish to pre-test that the combination of extensions and features is working.

For features the devcontainer CLI can create a devcontainer-lock.json file, but extensions are considered a VS Code customization, so there doesn't seem to be a way to pin the version.

Take for example:

{
    "name": "Test",
    "build": {
        "dockerfile": "./Dockerfile",
        "context": "."
    },
    "features": {
      "ghcr.io/devcontainers/features/powershell:1": {
        "version": "7.4"
      }
    },
    "customizations": {
        "vscode": {
            "extensions": [
                "ms-dotnettools.csdevkit",
                "ms-azuretools.vscode-azurefunctions",
                "ms-azuretools.vscode-azurestorage",
                "editorconfig.editorconfig",
                "esbenp.prettier-vscode"
            ]
        }
    }
}

Is there a way to pin the version of an extension being installed? Ideally I'm looking to create a similar lock file, but I don't think that concept exists.

Per the schema for .customizations.vscode (available via the main devcontainers.json schema), within the extensions array it accepts the following string formats:

Expected format: '${publisher}.${name}', '-${publisher}.${name}' or '${publisher}.${name}@${version}'. Example: 'ms-dotnettools.csharp'.

Therefore to pin the current version (at time of writing) of C# Dev Kit, you'd put:

{
    // ...
    "customizations": {
        "vscode": {
            "extensions": [
                "ms-dotnettools.csdevkit@1.41.5",
                // ...
            ]
        }
    }
}