Can I pin the package so it will not change when I do an update? Maybe with a
lockfile?
Can I create an appimage of it?
I tried
nix profile install nixpkgs/b5b7bd6ebba2a165e33726b570d7ab35177cf951#audacity
but got error: getting status of ‘/nix/store/7mgzqmz0h4bnls36jimk4krqlrkbl3w8-source/flake.nix’: No such file or directory
What might work is to create your own flake, that loads that old nixpkgs commit you need as a flake input with flake = false, imports it and exposes the audacity version.
Instead though I would suggest to use one of the many forks that came up, as I understand it, because of the telemetry issues you mention.