diff --git a/lib/workers/repository/onboarding.js b/lib/workers/repository/onboarding.js
index 0fd7ff1227d4658dda84e3fa60e88a3428e95c77..169a4d5e4e22619262c8530b7dacf740e1d8c5f1 100644
--- a/lib/workers/repository/onboarding.js
+++ b/lib/workers/repository/onboarding.js
@@ -8,6 +8,7 @@ const onboardPrTitle = 'Configure Renovate';
 
 module.exports = {
   determineSemanticCommits,
+  isRepoPrivate,
   createBranch,
   ensurePr,
   getOnboardingStatus,
@@ -27,11 +28,29 @@ async function determineSemanticCommits(config) {
   return true;
 }
 
+async function isRepoPrivate(config) {
+  let repoIsPrivate = true;
+  for (const packageFile of config.packageFiles) {
+    const fileName =
+      typeof packageFile === 'string' ? packageFile : packageFile.packageFile;
+    const packageContent = await config.api.getFileJson(fileName);
+    repoIsPrivate = repoIsPrivate && packageContent && packageContent.private;
+  }
+  return repoIsPrivate === true;
+}
+
 async function createBranch(config) {
   const onboardingConfig = configParser.getOnboardingConfig(config);
   onboardingConfig.semanticCommits = await module.exports.determineSemanticCommits(
     config
   );
+  const repoIsPrivate = await module.exports.isRepoPrivate(config);
+  if (repoIsPrivate) {
+    config.logger.debug('Repo is private - pinning dependencies versions');
+  } else {
+    config.logger.debug('Repo is not private - unpinning versions');
+    onboardingConfig.depTypes[0].pinVersions = false;
+  }
   const onboardingConfigString = `${stringify(onboardingConfig)}\n`;
   await config.api.commitFilesToBranch(
     onboardBranchName,
diff --git a/test/workers/repository/__snapshots__/onboarding.spec.js.snap b/test/workers/repository/__snapshots__/onboarding.spec.js.snap
index ef25ad33f9732c00b3f40d85f2d3f7ac1fd69c28..b46c692780824086c1befe5e42a3e10f054a51eb 100644
--- a/test/workers/repository/__snapshots__/onboarding.spec.js.snap
+++ b/test/workers/repository/__snapshots__/onboarding.spec.js.snap
@@ -212,7 +212,11 @@ Array [
   \\"schedule\\": [],
   \\"packageFiles\\": [],
   \\"depTypes\\": [
-    {\\"depType\\": \\"dependencies\\", \\"semanticPrefix\\": \\"fix(deps): \\"},
+    {
+      \\"depType\\": \\"dependencies\\",
+      \\"semanticPrefix\\": \\"fix(deps): \\",
+      \\"pinVersions\\": false
+    },
     \\"devDependencies\\",
     \\"optionalDependencies\\"
   ],
@@ -249,7 +253,11 @@ Array [
   \\"schedule\\": [],
   \\"packageFiles\\": [],
   \\"depTypes\\": [
-    {\\"depType\\": \\"dependencies\\", \\"semanticPrefix\\": \\"fix(deps): \\"},
+    {
+      \\"depType\\": \\"dependencies\\",
+      \\"semanticPrefix\\": \\"fix(deps): \\",
+      \\"pinVersions\\": false
+    },
     \\"devDependencies\\",
     \\"optionalDependencies\\"
   ],
@@ -274,3 +282,44 @@ Array [
   "Add renovate.json",
 ]
 `;
+
+exports[`lib/workers/repository/onboarding getOnboardingStatus(config) pins private repos 1`] = `
+Array [
+  "renovate/configure",
+  Array [
+    Object {
+      "contents": "{
+  \\"enabled\\": true,
+  \\"timezone\\": null,
+  \\"schedule\\": [],
+  \\"packageFiles\\": [],
+  \\"depTypes\\": [
+    {
+      \\"depType\\": \\"dependencies\\",
+      \\"semanticPrefix\\": \\"fix(deps): \\",
+      \\"pinVersions\\": false
+    },
+    \\"devDependencies\\",
+    \\"optionalDependencies\\"
+  ],
+  \\"ignoreDeps\\": [],
+  \\"pinVersions\\": true,
+  \\"separateMajorReleases\\": true,
+  \\"semanticCommits\\": false,
+  \\"semanticPrefix\\": \\"chore(deps): \\",
+  \\"rebaseStalePrs\\": false,
+  \\"prCreation\\": \\"immediate\\",
+  \\"automerge\\": \\"none\\",
+  \\"branchName\\": \\"renovate/{{depName}}-{{newVersionMajor}}.x\\",
+  \\"commitMessage\\": \\"{{semanticPrefix}}Update dependency {{depName}} to version {{newVersion}}\\",
+  \\"labels\\": [],
+  \\"assignees\\": [],
+  \\"reviewers\\": []
+}
+",
+      "name": "renovate.json",
+    },
+  ],
+  "Add renovate.json",
+]
+`;
diff --git a/test/workers/repository/onboarding.spec.js b/test/workers/repository/onboarding.spec.js
index 1b8b93284ef47e455e8ec57337f86656bd0c2eb4..fec0365ed4b4651cb28127fe64c8a1b0f04c11fc 100644
--- a/test/workers/repository/onboarding.spec.js
+++ b/test/workers/repository/onboarding.spec.js
@@ -3,6 +3,32 @@ const logger = require('../../_fixtures/logger');
 const defaultConfig = require('../../../lib/config/defaults').getConfig();
 
 describe('lib/workers/repository/onboarding', () => {
+  describe('isRepoPrivate(config)', () => {
+    let config;
+    beforeEach(() => {
+      config = {
+        api: {
+          getFileJson: jest.fn(),
+        },
+        packageFiles: [
+          'package.json',
+          {
+            packageFile: 'a/package.json',
+          },
+        ],
+      };
+    });
+    it('returns true if all are private', async () => {
+      config.api.getFileJson.mockReturnValueOnce({ private: true });
+      config.api.getFileJson.mockReturnValueOnce({ private: true });
+      expect(await onboarding.isRepoPrivate(config)).toBe(true);
+    });
+    it('returns false if some are not private', async () => {
+      config.api.getFileJson.mockReturnValueOnce({ private: true });
+      config.api.getFileJson.mockReturnValueOnce({});
+      expect(await onboarding.isRepoPrivate(config)).toBe(false);
+    });
+  });
   describe('ensurePr(config, branchUpgrades)', () => {
     let config;
     let branchUpgrades;
@@ -182,6 +208,7 @@ describe('lib/workers/repository/onboarding', () => {
       };
       config.logger = logger;
       config.detectedPackageFiles = true;
+      onboarding.isRepoPrivate = jest.fn();
     });
     it('returns true if onboarding is false', async () => {
       config.onboarding = false;
@@ -235,5 +262,13 @@ describe('lib/workers/repository/onboarding', () => {
       expect(config.api.commitFilesToBranch.mock.calls.length).toBe(1);
       expect(config.api.commitFilesToBranch.mock.calls[0]).toMatchSnapshot();
     });
+    it('pins private repos', async () => {
+      onboarding.isRepoPrivate.mockReturnValueOnce(true);
+      const res = await onboarding.getOnboardingStatus(config);
+      expect(res).toEqual(false);
+      expect(config.api.findPr.mock.calls.length).toBe(1);
+      expect(config.api.commitFilesToBranch.mock.calls.length).toBe(1);
+      expect(config.api.commitFilesToBranch.mock.calls[0]).toMatchSnapshot();
+    });
   });
 });