Pins usually hash the SubjectPublicKeyInfo (sha256/… in OkHttp and Android's network security config), so a renewed certificate with the same key still matches. Pinning a CA or intermediate key is more resilient than pinning a leaf; any pin set needs at least one backup key that is not in production.
The web gave up on dynamic pinning: HTTP Public Key Pinning (RFC 7469) caused self-inflicted outages and "hostile pinning", Chrome removed it in version 72 (2019) and Firefox disabled it by default in version 72 (2020). Browsers keep a small built-in pin list for their vendors' domains. Certificate Transparency and CAA cover most of the threat HPKP targeted.
In mobile apps and IoT, pinning remains common but carries the same risk: shorter certificate lifetimes, CA key rotations (Let's Encrypt changed intermediates in 2024 and 2026) and distrust events break pinned clients that cannot be updated quickly. The SPKI pin generator computes pins from certificates or keys.