Update: lock chef at the one we're using on OpsWorks