Lock CATS to a known good SHA (for now)