diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02ebbec1..03e8793a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,9 +35,10 @@ jobs:
       release: ${{ steps.config.outputs.release }}
       retention-days: ${{ steps.config.outputs.retention-days }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: config
         id: config
@@ -94,9 +95,10 @@ jobs:
       VERSION: ${{ needs.config.outputs.version }}
       RELEASE: ${{ needs.config.outputs.release }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           submodules: true
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: actions/setup-python@v2
         with:
@@ -281,9 +283,10 @@ jobs:
           #  os: windows-2019
           #  continue-on-error: true  # TODO: get Python client to work on Windows
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           submodules: true
+          ref: ${{ github.event.pull_request.head.sha }}
 
       # Homebrew installs packages in different directories depending on which
       # macOS architecture you are using:
@@ -457,7 +460,9 @@ jobs:
           cache-to: type=registry,ref=${{ matrix.cache }}:cache-${{ steps.common-tag.outputs.common-tag }},mode=max
 
       - if: matrix.image == 'ghcr.io/galoisinc/cryptol-remote-api'
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - if: matrix.image == 'ghcr.io/galoisinc/cryptol-remote-api'
         uses: actions/setup-python@v2
diff --git a/cry b/cry
index d2436b3f..63964cbc 100755
--- a/cry
+++ b/cry
@@ -44,25 +44,17 @@ case $COMMAND in
     # XXX: This is a workaround the fact that currently Cabal
     # will not rebuild this file, even though it has TH code, that
     # depends on the environment.  For now, we temporarily modify the
-    # file, then build, then revert it back after build.
+    # file, then build, then revert it back, then build once more.
 
     dirty_string="-- Last build $(date)"
     echo "$dirty_string" >> src/GitRev.hs
 
-    if [[ -n "$RELEASE" ]]; then
-      sed -i.bak -e 's/^commitShortHash = .*$/commitShortHash = "UNKNOWN"/' \
-        -e 's/^commitHash = .*$/commitHash = "UNKNOWN"/' \
-        -e 's/^commitBranch = .*$/commitBranch = "UNKNOWN"/' \
-        -e 's/^commitDirty = .*$/commitDirty = False/' \
-        -e '/import qualified GitRev/d' \
-        src/Cryptol/Version.hs
-      rm -f src/Cryptol/Version.hs.bak
-    fi
-
     cabal v2-build "$@" exe:cryptol
 
     sed -i.bak "/^-- Last build/d" src/GitRev.hs
     rm -f src/GitRev.hs.bak
+
+    cabal v2-build "$@" exe:cryptol
     ;;
 
   haddock) echo Building Haddock documentation && cabal v2-haddock ;;