diff --git a/.github/workflows/build_aarch64.yml b/.github/workflows/build_aarch64.yml
index 0af18423761..8f1565e1668 100644
--- a/.github/workflows/build_aarch64.yml
+++ b/.github/workflows/build_aarch64.yml
@@ -26,6 +26,11 @@ on:
     tags:
       - '*'
 
+# Please remember to update values for both x86 and aarch64 workflows.
+env:
+  PACKAGING_REPO: https://github.com/osquery/osquery-packaging
+  PACKAGING_COMMIT: 3946326992b49c4b962ef998a2c7924efa80aa26
+
 # If the initial code sanity checks are passing, then one job
 # per [`platform` * `build_type`] will start, building osquery
 # and generating packages that are later attached to the commit
@@ -232,8 +237,10 @@ jobs:
 
     - name: Clone the osquery-packaging repository
       run: |
-        git clone https://github.com/osquery/osquery-packaging \
+        git clone ${{ env.PACKAGING_REPO }} \
           ${{ steps.build_paths.outputs.PACKAGING }}
+        cd ${{ steps.build_paths.outputs.PACKAGING }}
+        git checkout ${{ env.PACKAGING_COMMIT }}
 
     # One of the tests in the test suit will spawn a Docker container
     # using this socket. Allow the unprivileged user we created
diff --git a/.github/workflows/build_x86.yml b/.github/workflows/build_x86.yml
index 778550683dc..2f77e8ef6e4 100644
--- a/.github/workflows/build_x86.yml
+++ b/.github/workflows/build_x86.yml
@@ -30,6 +30,11 @@ on:
     branches:
       - '*'
 
+# Please remember to update values for both x86 and aarch64 workflows.
+env:
+  PACKAGING_REPO: https://github.com/osquery/osquery-packaging
+  PACKAGING_COMMIT: 3946326992b49c4b962ef998a2c7924efa80aa26
+
 # If the initial code sanity checks are passing, then one job
 # per [`platform` * `build_type`] will start, building osquery
 # and generating packages that are later attached to the commit
@@ -299,8 +304,10 @@ jobs:
 
     - name: Clone the osquery-packaging repository
       run: |
-        git clone https://github.com/osquery/osquery-packaging \
+        git clone ${{ env.PACKAGING_REPO }} \
           ${{ steps.build_paths.outputs.PACKAGING }}
+        cd ${{ steps.build_paths.outputs.PACKAGING }}
+        git checkout ${{ env.PACKAGING_COMMIT }}
 
     # One of the tests in the test suit will spawn a Docker container
     # using this socket. Allow the unprivileged user we created
@@ -543,8 +550,10 @@ jobs:
 
     - name: Clone the osquery-packaging repository
       run: |
-        git clone https://github.com/osquery/osquery-packaging \
+        git clone ${{ env.PACKAGING_REPO }} \
           ${{ steps.build_paths.outputs.PACKAGING }}
+        cd ${{ steps.build_paths.outputs.PACKAGING }}
+        git checkout ${{ env.PACKAGING_COMMIT }}
 
     - name: Update the cache (ccache)
       uses: actions/cache@v2
@@ -821,7 +830,9 @@ jobs:
     - name: Clone the osquery-packaging repository
       run: |
         cd w
-        git clone https://github.com/osquery/osquery-packaging
+        git clone ${{ env.PACKAGING_REPO }}
+        cd ${{ steps.build_paths.outputs.PACKAGING }}
+        git checkout ${{ env.PACKAGING_COMMIT }}
 
     - name: Update the cache (git submodules)
       uses: actions/cache@v2