diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 733986c..650e66b 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -8,12 +8,12 @@ on:
 
 jobs:
   check:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@master
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
     with:
       java-version: 17
 
   docker:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-service-check.yml@master
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-check.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
     with:
       java-version: 17
       image-tag: wetransform/hale-cli:latest # image to scan
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 254a3c1..2d4ea9b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,10 +14,11 @@ concurrency:
 
 jobs:
   artifacts:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@master
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
     with:
       java-version: 17
-      gradle-tasks: clean check distZip buildDeb publish
+      build-tasks: clean check distZip buildDeb
+      publish-tasks: publish
       upload-artifact-path: build/distributions
       upload-artifact-name: distributions
     secrets:
@@ -25,7 +26,7 @@ jobs:
 
   docker:
     # FIXME both master and devel will push latest - only one should
-    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@master
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@ef7e7ff0d5f77914d591c783f3dcf854e3c4e204
     with:
       java-version: 17
       image-tag: wetransform/hale-cli:latest # image to scan