Refer to actual versions instead of shas