Use tagged pzp commit-ish as dependencies