Manually uploading a bundled plugin should trigger pin-down.

changelog.html

@@ -66,6 +66,8 @@ Upcoming changes</a>
   <li class=bug>
     404 when clicking in the weather report column of a build that hasn't yet been run.
     (<a href="http://issues.jenkins-ci.org/browse/JENKINS-9532">issue 9532</a>)
+  <li class=bug>
+    Manually uploading a bundled plugin should trigger pin-down.
   <li class=rfe>
     Add active configurations in remote API for matrix projects.
     (<a href="http://issues.jenkins-ci.org/browse/JENKINS-9248">issue 9248</a>)

core/src/main/java/hudson/PluginManager.java

@@ -43,6 +43,7 @@ import org.apache.commons.fileupload.FileItem;
 import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.servlet.ServletFileUpload;
 import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.logging.LogFactory;
 import org.jvnet.hudson.reactor.Executable;
 import org.jvnet.hudson.reactor.Reactor;
@@ -584,6 +585,10 @@ public abstract class PluginManager extends AbstractModelObject {
             fileItem.write(new File(rootDir, fileName));
             fileItem.delete();
 
+            PluginWrapper existing = getPlugin(FilenameUtils.getBaseName(fileName));
+            if (existing!=null && existing.isBundled)
+                existing.doPin();
+
             pluginUploaded = true;
 
             return new HttpRedirect(".");