diff --git a/discovery_workspace.go b/discovery_workspace.go
index b232ddd..06dc4e2 100644
--- a/discovery_workspace.go
+++ b/discovery_workspace.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"github.com/BurntSushi/toml"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func (d *manifestDiscovery) discoverCargoWorkspace() error {
diff --git a/go.mod b/go.mod
index 28db6e0..3e61f91 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/bmatcuk/doublestar/v4 v4.10.0
 	github.com/git-pkgs/pom v0.1.7
 	github.com/git-pkgs/purl v0.1.20
-	gopkg.in/yaml.v3 v3.0.1
+	go.yaml.in/yaml/v3 v3.0.5
 )
 
 require (
diff --git a/go.sum b/go.sum
index 8482d14..edca4f4 100644
--- a/go.sum
+++ b/go.sum
@@ -12,7 +12,5 @@ github.com/git-pkgs/vers v0.7.0 h1:7PD2DKFB8jTDIfiyWXbqYW54iVuNkFCBgXHgxOTdr8A=
 github.com/git-pkgs/vers v0.7.0/go.mod h1:ofLiBpPNkQmC0LB1k0zmN1gCv7Hi3MiZx8WtmWZ4A9A=
 github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY=
 github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
diff --git a/internal/conda/conda.go b/internal/conda/conda.go
index 8dd9368..8d997c0 100644
--- a/internal/conda/conda.go
+++ b/internal/conda/conda.go
@@ -4,7 +4,7 @@ import (
 	"github.com/git-pkgs/manifests/internal/core"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 const condaChannelURLParts = 4 // scheme + empty + host + channel
diff --git a/internal/cpan/cpan.go b/internal/cpan/cpan.go
index cde3f7c..d374755 100644
--- a/internal/cpan/cpan.go
+++ b/internal/cpan/cpan.go
@@ -7,7 +7,7 @@ import (
 	"regexp"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 const perlPackage = "perl"
diff --git a/internal/crystal/crystal.go b/internal/crystal/crystal.go
index d2a2f6f..648bdae 100644
--- a/internal/crystal/crystal.go
+++ b/internal/crystal/crystal.go
@@ -4,7 +4,7 @@ import (
 	"github.com/git-pkgs/manifests/internal/core"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/docker/docker.go b/internal/docker/docker.go
index 4faaed0..6d07749 100644
--- a/internal/docker/docker.go
+++ b/internal/docker/docker.go
@@ -5,7 +5,7 @@ import (
 	"regexp"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/github_actions/actions_lock.go b/internal/github_actions/actions_lock.go
index 9825aaf..e5a6e3a 100644
--- a/internal/github_actions/actions_lock.go
+++ b/internal/github_actions/actions_lock.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	"github.com/git-pkgs/manifests/internal/core"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/github_actions/github_actions.go b/internal/github_actions/github_actions.go
index 41891bb..2cf69a6 100644
--- a/internal/github_actions/github_actions.go
+++ b/internal/github_actions/github_actions.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/git-pkgs/manifests/internal/core"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/golang/legacy.go b/internal/golang/legacy.go
index 7495bce..852bd2b 100644
--- a/internal/golang/legacy.go
+++ b/internal/golang/legacy.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/BurntSushi/toml"
 	"github.com/git-pkgs/manifests/internal/core"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 const basePackageSegments = 3 // e.g. github.com/owner/repo
diff --git a/internal/hackage/hackage.go b/internal/hackage/hackage.go
index cb58903..8dada2f 100644
--- a/internal/hackage/hackage.go
+++ b/internal/hackage/hackage.go
@@ -5,7 +5,7 @@ import (
 	"regexp"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/helm/helm.go b/internal/helm/helm.go
index 9deda3e..858dee8 100644
--- a/internal/helm/helm.go
+++ b/internal/helm/helm.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 
 	"github.com/git-pkgs/manifests/internal/core"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/precommit/precommit.go b/internal/precommit/precommit.go
index 8850e3e..dde0380 100644
--- a/internal/precommit/precommit.go
+++ b/internal/precommit/precommit.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/BurntSushi/toml"
 	"github.com/git-pkgs/manifests/internal/core"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {
diff --git a/internal/pub/pub.go b/internal/pub/pub.go
index 272e74a..4746153 100644
--- a/internal/pub/pub.go
+++ b/internal/pub/pub.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 
 	"github.com/git-pkgs/manifests/internal/core"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func init() {