Short answer: the Dock rarely rearranges by itself. Four different things get called rearranging, and they have four different fixes.
If you want it to stop for good regardless of which one it is:
defaults write com.apple.dock contents-immutable -bool true; killall Dock
Before changing anything, look at what actually moved. The fix depends on what moved.
The new icons come from the recent apps section. Nothing you placed has moved; a temporary group grew beside it. Turn it off in System Settings › Desktop & Dock, or see how to stop recent and suggested apps.
The Dock was resized or moved, most often by a brush of the divider or by connecting a display. The order is intact. See why the Dock keeps changing size and why it changes when you connect a monitor.
Something dragged them, and on a Mac only three things realistically do: a person, a trackpad misread as a drag, or an installer adding itself. macOS does not reorder pinned icons on its own.
An accidental drag is more common than people expect, because a slow drag on a trackpad reads as a deliberate one. System Settings › Accessibility › Pointer Control › Trackpad Options, and the dragging style there, is worth checking if it keeps happening.
A Dock that comes back with Apple's defaults has been reset, which usually follows an update or a preference file being rebuilt. See why the Dock resets itself.
The contents lock stops the Dock's contents changing at all: no dragging out, no reordering, no new icons added. It is one setting and it covers cases one, three and four.
defaults write com.apple.dock contents-immutable -bool true
killall Dock
Set the Dock up the way you want it first. The lock freezes what is there, so locking a Dock you
have not tidied preserves the mess. To release it, swap true for false.
If the size or position is also drifting, the other three locks are documented in three ways to lock the Mac Dock, and our free command generator writes whichever combination you want with the undo commands alongside.
A macOS upgrade is the single most common trigger. An upgrade can rebuild com.apple.dock from defaults, which discards preferences that were never explicitly written. Anything you set once in a settings pane years ago is the most likely to vanish.
Values written from Terminal or delivered by a configuration profile survive, so set them deliberately.
No. Apps install normally and appear in Launchpad and the Applications folder. The lock stops them being added to the Dock, and stops icons being dragged out of it.
Check the order carefully. Connecting a display usually resizes the icons and leaves their order alone, and a Dock with smaller icons reads as a different Dock at a glance. See the monitor guide.
Yes.
contents-immutable is written to your preferences and applies at every login. It is per
user, so on a shared Mac each account needs it, or a configuration profile for all of them.
If you would rather not keep a list of commands, Still Dock is the same four settings as switches, and it remembers the Dock you had before you locked it. The size lock is free.