Should we lock this to a specific version / sha?