diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 650e66b..b6b687f 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -8,12 +8,12 @@ on:
 
 jobs:
   check:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
     with:
       java-version: 17
 
   docker:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-service-check.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-check.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
     with:
       java-version: 17
       image-tag: wetransform/hale-cli:latest # image to scan
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2d4ea9b..6f57f51 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   artifacts:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
     with:
       java-version: 17
       build-tasks: clean check distZip buildDeb
@@ -26,7 +26,7 @@ jobs:
 
   docker:
     # FIXME both master and devel will push latest - only one should
-    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
     with:
       java-version: 17
       image-tag: wetransform/hale-cli:latest # image to scan