Where are version-locked packages defined?

We manage a server farm of RHEL 9 machines via Red Hat Satellite and Ansible Tower (AWX). On some machines the dnf versionlock command outputs packages **"foo"** and **"bar"** as versionlocked. Hovever, our Ansible configuration for these machines (using module community.general.yum_versionlock -- not community.general.dnf_versionlock as we had yum-based old RHEL servers in the past) is set to versionlock the packages **"foo"** and **"quux"**. So, where are all the places where version-locked packages are defined? In particular, is there some setting in Satellite, perhaps related to Repos/Products/Hosts?