If I specify a specific branch/version using go get github.com/org/package@sha_or_branch it will update accordingly. But if I run go get -u afterwards it gets overridden with any newer version.
Is there any way to lock it in so it doesn't change when doing a go get -u?
There is no way to do this currently.
You can only specify if want to use the defined versions of the transitive dependencies of the packages you directly import or allow using a newer minor or patch version.