You can pin a certificate higher in the chain, like the root cert of your CA. That way, you can still rotate your own cert, but an attacker couldn't just install a new root cert in the machine, they would have to get a cert from the same CA as your own.

Do any of the publicly available CAs provide a guarantee that you can pin them? I remember there was at least one case of someone pinning a CA and making the news because the page could not load anymore.

I can't say I know, but I don't think they can simply replace them at will, otherwise wouldn't existing certs just stop working?

The intermediates can be replaced without issues, as long as they link to the same root certificates. That's the standard way to rotate them when they expire, or get compromised.

When are you talking about them being replaced? Because I thought website certificates embed the signature of the signer (the intermediate), so if the intermediate is revoked, my website's certificate won't work anymore. If that's the case I should be fairly safe pinning the intermediate for as long as my website certificate is valid.

Ah, yes, but my suggestion was to pin the root.

CAs will not arbitrarily throw out their root certificates (they're quite expensive and valuable), so you'll be fine pinning to a root. I'd advise against it when you use OV or EV certificates though, as it'd allow for a DV certificate to still work.

You can pin (multiple) private keys. Usually, you don't have to change your private key when getting a new certificate (for example, with Lets Encrypt).

If you do want to change private keys regularly, generate them beforehand and pin them.