diff --git a/ansible/group_vars/cluster/settings.yml.example b/ansible/group_vars/cluster/settings.yml.example
index 6fce66e6983d29a9def8249681984d176a1e2e8f..694a3ac464c21b2539d4a5821a42470f2bb750b8 100644
--- a/ansible/group_vars/cluster/settings.yml.example
+++ b/ansible/group_vars/cluster/settings.yml.example
@@ -17,3 +17,8 @@ nextcloud_password: "{{ lookup('password', './secrets/nextcloud_admin_password c
 # Note that LE's production server has stricter rate limits, so set this to
 # "true" when you are testing something.
 acme_staging: false
+
+# git repo versions
+git_helmfiles_version: '3c97c3f'
+git_charts_version: 'HEAD'
+git_local_storage_version: 'HEAD'
diff --git a/ansible/roles/setup/tasks/main.yml b/ansible/roles/setup/tasks/main.yml
index a4dabb93848b01f682dd153f65ba230224d555fa..e267e2b70b2ae22c87c5ae934ddfae6db240be2d 100644
--- a/ansible/roles/setup/tasks/main.yml
+++ b/ansible/roles/setup/tasks/main.yml
@@ -156,7 +156,7 @@
   git:
     repo: 'https://code.greenhost.net/openappstack/helmfiles'
     dest: '/oas/source/repos/helmfiles'
-    version: "master"
+    version: '{{ git_helmfiles_version }}'
 
 - name: Clone charts repo
   tags:
@@ -164,6 +164,7 @@
   git:
     repo: 'https://code.greenhost.net/openappstack/charts'
     dest: '/oas/source/repos/charts'
+    version: '{{ git_charts_version }}'
 
 - name: Clone local-storage repo
   tags:
@@ -171,6 +172,7 @@
   git:
     repo: 'https://code.greenhost.net/openappstack/local-storage'
     dest: '/oas/source/repos/local-storage'
+    version: '{{ git_local_storage_version }}'
 
 - name: Create OAS namespaces
   tags: