fix: using pinned commit hashes, using just universally