diff --git a/manifests/plugin.pp b/manifests/plugin.pp
index f194da7de..677225cf5 100644
--- a/manifests/plugin.pp
+++ b/manifests/plugin.pp
@@ -26,6 +26,7 @@
   $digest_string   = '',
   $digest_type     = 'sha1',
   $timeout         = 120,
+  $pin             = false,
   # deprecated
   $plugin_dir      = undef,
   $username        = undef,
@@ -36,6 +37,7 @@
 
   validate_bool($manage_config)
   validate_bool($enabled)
+  validate_bool($pin)
   # TODO: validate_str($update_url)
   validate_string($source)
   validate_string($digest_string)
@@ -102,8 +104,13 @@
       notify  => Service['jenkins'],
     }
 
+    $pinned_ensure = $pin ? {
+      true    => file,
+      default => undef,
+    }
+
     file { "${::jenkins::plugin_dir}/${plugin}.pinned":
-      ensure  => file,
+      ensure  => $pinned_ensure,
       owner   => $::jenkins::user,
       group   => $::jenkins::group,
       require => Archive::Download[$plugin],
diff --git a/spec/defines/jenkins_plugin_spec.rb b/spec/defines/jenkins_plugin_spec.rb
index 0e7c097f4..6ca8b934e 100644
--- a/spec/defines/jenkins_plugin_spec.rb
+++ b/spec/defines/jenkins_plugin_spec.rb
@@ -140,7 +140,7 @@
   describe 'source' do
     shared_examples 'should download from $source url' do
       it 'should download from $source url' do
-         should contain_archive__download('myplug.hpi').with(
+        should contain_archive__download('myplug.hpi').with(
           :url  => 'http://e.org/myplug.hpi',
           :user => 'jenkins',
         )
@@ -205,6 +205,26 @@
         ).that_requires('Archive::Download[foo.jpi]')
       end
     end
+
+    describe 'pin parameter' do
+      context 'with pin => true' do
+        let(:params) {{ :pin => true } }
+        it do
+          should contain_file('/var/lib/jenkins/plugins/foo.hpi.pinned').with_ensure('file')
+        end
+      end
+      context 'with pin => false' do
+        let(:params) {{ :pin => false } }
+        it do
+          should contain_file('/var/lib/jenkins/plugins/foo.hpi.pinned').without_ensure
+        end
+      end
+      context 'with default pin param' do
+        it do
+          should contain_file('/var/lib/jenkins/plugins/foo.hpi.pinned').without_ensure
+        end
+      end
+    end
   end # pinned file extension name