diff --git a/.github/workflows/build-test-distribute.yaml b/.github/workflows/build-test-distribute.yaml
index c336adb9de24..ff210f691c07 100644
--- a/.github/workflows/build-test-distribute.yaml
+++ b/.github/workflows/build-test-distribute.yaml
@@ -141,7 +141,7 @@ jobs:
       - name: "Download all SBOM assets"
         id: collect_sbom
         if: ${{ needs.build_publish.result == 'success' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: ${{ env.SECURITY_ASSETS_DOWNLOAD_PATH }}
           pattern: "*sbom.{cyclonedx,spdx}.json"
@@ -151,7 +151,7 @@ jobs:
       - name: "Download binary artifact provenance"
         if: ${{ needs.provenance.result == 'success' && github.ref_type == 'tag' }}
         id: collect_provenance
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: ${{ env.SECURITY_ASSETS_DOWNLOAD_PATH }}
           pattern: ${{ github.event.repository.name }}.intoto.jsonl
diff --git a/app/kumactl/cmd/install/render_helm_files.go b/app/kumactl/cmd/install/render_helm_files.go
index 745ffe41e4c9..a4a8ac1d7138 100644
--- a/app/kumactl/cmd/install/render_helm_files.go
+++ b/app/kumactl/cmd/install/render_helm_files.go
@@ -27,7 +27,7 @@ func labelRegex(label string) *regexp.Regexp {
 var stripLabelsRegexps = []*regexp.Regexp{
 	labelRegex("app\\.kubernetes\\.io/managed-by"),
 	labelRegex("helm\\.sh/chart"),
-	labelRegex("app.kubernetes\\.io/version"),
+	labelRegex("app\\.kubernetes\\.io/version"),
 }
 
 var kumaSystemNamespace = func(namespace string) string {
diff --git a/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go b/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go
index 6bdff346681c..e5696d5e1709 100644
--- a/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go
+++ b/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go
@@ -101,8 +101,8 @@ func ApplicationProbeProxy() {
 			container := getAppContainer(httpPod, httpAppName)
 			g.Expect(container).ToNot(BeNil())
 			g.Expect(container.ReadinessProbe.HTTPGet).ToNot(BeNil())
-			probeProxyPort, _ := strconv.Atoi(probeProxyPortAnno)
-			g.Expect(container.ReadinessProbe.HTTPGet.Port).To(Equal(intstr.FromInt32(int32(probeProxyPort)))) //nolint:gosec  // we never overflow here
+			port := intstr.FromString(probeProxyPortAnno)
+			g.Expect(container.ReadinessProbe.HTTPGet.Port.IntValue()).To(Equal(port.IntValue()))
 			g.Expect(container.ReadinessProbe.HTTPGet.Path).To(Equal("/80/probes?type=readiness"))
 		}, "30s", "1s").Should(Succeed())
 
@@ -194,8 +194,8 @@ func ApplicationProbeProxy() {
 			g.Expect(container).ToNot(BeNil())
 			g.Expect(container.ReadinessProbe.HTTPGet).ToNot(BeNil())
 
-			port, _ := strconv.Atoi(virtualProbesPortAnno)
-			g.Expect(container.ReadinessProbe.HTTPGet.Port).To(Equal(intstr.FromInt32(int32(port)))) //nolint:gosec  // we never overflow here
+			port := intstr.FromString(virtualProbesPortAnno)
+			g.Expect(container.ReadinessProbe.HTTPGet.Port.IntValue()).To(Equal(port.IntValue()))
 			g.Expect(container.ReadinessProbe.HTTPGet.Path).To(Equal("/80/probes?type=readiness"))
 		}, "30s", "1s").Should(Succeed())