diff --git a/.github/workflows/push-ld.yml b/.github/workflows/push-ld.yml
index 9a47a38d..4f4b12ee 100644
--- a/.github/workflows/push-ld.yml
+++ b/.github/workflows/push-ld.yml
@@ -16,7 +16,7 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v3
-      - uses: sigstore/cosign-installer@main
+      - uses: sigstore/cosign-installer@v2.8.1
       - name: Prepare
         id: prep
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 58a0f27e..492e3d12 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,9 +19,8 @@ jobs:
       packages: write # needed for ghcr access
     steps:
       - uses: actions/checkout@v3
-      - uses: fluxcd/pkg/actions/helm@main
       - uses: fluxcd/flux2/action@main
-      - uses: sigstore/cosign-installer@main
+      - uses: sigstore/cosign-installer@v2.8.1
       - name: Prepare
         id: prep
         run: |
@@ -72,6 +71,9 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           charts_url: https://flagger.app
           linting: off
+      - uses: fluxcd/pkg/actions/helm@main
+        with:
+          version: 3.10.1
       - name: Publish signed Helm chart to GHCR
         env:
           COSIGN_EXPERIMENTAL: 1