I'm having some doubts here - we could just apply this to the build of standalone (handled by a private devops repo) rather than to the pyproject.toml. The downside of pinning here is that it will alter a lot of people's python installations, and cause pip annoying warnings and potentially poetry/pdm resolver clashes for downstream packages

Making it an exclusive change to py3.8 standalone app sounds good to me...

One possible issue is that folks doing pip install psychopy with pip > 24.0 might have trouble using the Plugins & Packages Manager to install plugin packages if they open the builder from this installation.

But I don't know how many people actually pip install themselves AND also use the builder - everyone I interact with use either standalone + builder or pip install + coder, and they can probably figure out pip installing plugin packages themselves as well if they pip installed psychopy in the first place :)