diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index aefe1f45..7da26ceb 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,7 +1,7 @@
 name: Build
 
 on:
-  pull_request: 
+  pull_request:
     branches: ['main']
 
 jobs:
@@ -10,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: ['1.17.x', '1.18.x']
+        go-version: ['1.17', '1.18']
     name: Build ${{ matrix.go-version }}
     runs-on: ubuntu-latest
 
@@ -19,6 +19,7 @@ jobs:
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go-version }}
+          check-latest: true
 
       - run: |
           go build ./...
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 65e20911..75a98884 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -19,7 +19,8 @@ jobs:
     - uses: actions/checkout@v3
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17.x
+        go-version: 1.17
+        check-latest: true
 
     - name: Build and run ko container
       env:
diff --git a/.github/workflows/go-1.18.yaml b/.github/workflows/go-1.18.yaml
index 6efd8842..846bc1b2 100644
--- a/.github/workflows/go-1.18.yaml
+++ b/.github/workflows/go-1.18.yaml
@@ -9,8 +9,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ko-go-version: ['1.17.x', '1.18.x']
-        user-go-version: ['1.17.x', '1.18.x']
+        ko-go-version: ['1.17', '1.18']
+        user-go-version: ['1.17', '1.18']
     name: Go 1.18 compat (ko=${{ matrix.ko-go-version }} / user=${{ matrix.user-go-version }})
     runs-on: ubuntu-latest
 
@@ -21,12 +21,14 @@ jobs:
     - uses: actions/setup-go@v3
       with:
         go-version: ${{ matrix.ko-go-version }}
+        check-latest: true
     - run: go install ./
 
     # Run ko using user-go-version
     - uses: actions/setup-go@v3
       with:
         go-version: ${{ matrix.user-go-version }}
+        check-latest: true
     - run: |
         go install github.com/google/go-containerregistry/cmd/registry@latest
         registry &
diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
index d9029507..5507e92f 100644
--- a/.github/workflows/image.yaml
+++ b/.github/workflows/image.yaml
@@ -17,8 +17,9 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17.x
-      - uses: sigstore/cosign-installer@v2.2.0
+          go-version: 1.17
+          check-latest: true
+      - uses: sigstore/cosign-installer@v2.2.1
 
       # Build ko from HEAD, build and push an image tagged with the commit SHA,
       # then keylessly sign it with cosign.
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index 5aa052d1..5d7b81e5 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -20,7 +20,9 @@ jobs:
     steps:
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17.x
+        go-version: 1.17
+        check-latest: true
+
     - uses: actions/checkout@v3
 
     - name: Install ko
@@ -33,9 +35,9 @@ jobs:
         registry-authority: ${{ env.REGISTRY_NAME }}:${{ env.REGISTRY_PORT }}
 
     - name: Install Cosign
-      uses: sigstore/cosign-installer@v2.2.0
+      uses: sigstore/cosign-installer@v2.2.1
       with:
-        cosign-release: 'v1.5.1'
+        cosign-release: 'v1.7.2'
 
     - name: Run Smoke Test
       run: |
diff --git a/.github/workflows/modules-integration-test.yaml b/.github/workflows/modules-integration-test.yaml
index d2e84845..9a3a378c 100644
--- a/.github/workflows/modules-integration-test.yaml
+++ b/.github/workflows/modules-integration-test.yaml
@@ -9,12 +9,15 @@ jobs:
     name: Module Tests
     strategy:
       matrix:
-        go-version: [1.17.x, 1.18.x]
+        go-version: [1.17, 1.18]
+
     runs-on: 'ubuntu-latest'
     steps:
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go-version }}
+          check-latest: true
+
       - uses: actions/checkout@v3
 
       - env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 647754ae..7389de63 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,8 @@ jobs:
       - run: git fetch --prune --unshallow
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.18.x
+          go-version: 1.18
+          check-latest: true
       - uses: goreleaser/goreleaser-action@v2.9.1
         with:
           version: latest
diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index d958ec97..d9fcaaac 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -1,7 +1,7 @@
 name: Validate SBOMs
 
 on:
-  pull_request: 
+  pull_request:
     branches: ['main']
 
 jobs:
@@ -15,7 +15,8 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.17.x'
+          go-version: 1.17
+          check-latest: true
       - name: Install cmd/registry
         run: |
           go install github.com/google/go-containerregistry/cmd/registry@latest
@@ -38,14 +39,15 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.17.x'
+          go-version: 1.17
+          check-latest: true
       - name: Install cmd/registry
         run: |
           go install github.com/google/go-containerregistry/cmd/registry@latest
           registry &
       - uses: actions/checkout@v3
 
-      - name: Install CycloneDX 
+      - name: Install CycloneDX
         run: |
           wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.22.0/cyclonedx-linux-x64
           chmod +x cyclonedx-linux-x64
@@ -72,7 +74,8 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.17.x'
+          go-version: 1.17
+          check-latest: true
       - name: Install cmd/registry
         run: |
           go install github.com/google/go-containerregistry/cmd/registry@latest
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index b4cda1e0..69e394d5 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -22,7 +22,7 @@ jobs:
         stale-pr-message: |-
           This Pull Request is stale because it has been open for 90 days with
           no activity. It will automatically close after 30 more days of
-          inactivity. Keep fresh with the 'lifecycle/frozen' label. 
+          inactivity. Keep fresh with the 'lifecycle/frozen' label.
         stale-pr-label: 'lifecycle/stale'
         exempt-pr-labels: 'lifecycle/frozen'
 
diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml
index 66919a9a..ecbf5d69 100644
--- a/.github/workflows/style.yaml
+++ b/.github/workflows/style.yaml
@@ -12,7 +12,8 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17.x
+          go-version: 1.17
+          check-latest: true
       - uses: actions/checkout@v3
       - uses: chainguard-dev/actions/gofmt@84c993eaf02da1c325854fb272a4df9184bd80fc # main
         with:
@@ -24,7 +25,8 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17.x
+          go-version: 1.17
+          check-latest: true
       - uses: actions/checkout@v3
       - uses: chainguard-dev/actions/goimports@84c993eaf02da1c325854fb272a4df9184bd80fc # main
 
@@ -36,7 +38,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.17.x
+          go-version: 1.17
+          check-latest: true
 
       - name: Check out code
         uses: actions/checkout@v3
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 9eaf7c7b..e16d54de 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -16,7 +16,8 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17.x
+          go-version: 1.17
+          check-latest: true
 
       - run: go test -coverprofile=coverage.txt -covermode=atomic -race ./...
 
diff --git a/.github/workflows/verify.yaml b/.github/workflows/verify.yaml
index bd28c454..ff8b5e9d 100644
--- a/.github/workflows/verify.yaml
+++ b/.github/workflows/verify.yaml
@@ -11,7 +11,8 @@ jobs:
     steps:
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17.x
+        go-version: 1.17
+        check-latest: true
     - uses: actions/checkout@v3
     - name: Verify
       run: ./hack/presubmit.sh