diff --git a/bin/y-bin.runner.yaml b/bin/y-bin.runner.yaml
index 61c3691..4513073 100755
--- a/bin/y-bin.runner.yaml
+++ b/bin/y-bin.runner.yaml
@@ -7,12 +7,12 @@
 
 # NOTE yq must be first in the file because this script depends on it
 yq:
-  version: 4.44.3
+  version: 4.44.6
   sha256:
-    darwin_amd64: 216ddfa03e7ba0e5aba00b236ec78324b5bfc49b610db254fe92310878baea20
-    darwin_arm64: 559a594ef7a6ebc5b81a67b7717fb3accedd266d8fa7d8352da7fec9e463f48b
-    linux_amd64: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
-    linux_arm64: 0e7e1524f68d91b3ff9b089872d185940ab0fa020a5a9052046ef10547023156
+    darwin_amd64: 71813c67f87766a532a072d9ef9c24dd5615f6b7d2e49b2a56cd26cf3de021e1
+    darwin_arm64: 164e10e5f7df62990e4f3823205e7ea42ba5660523a428df07c7386c0b62e3d9
+    linux_amd64: 0c2b24e645b57d8e7c0566d18643a6d4f5580feeea3878127354a46f2a1e4598
+    linux_arm64: 9477ac3cc447b6c083986129e35af8122eb2b938fe55c9c3e40436fb966e5813
   templates:
     download: https://github.com/mikefarah/yq/releases/download/v${version}/yq_${os}_${arch}
     # Must be parsed based on: https://github.com/mikefarah/yq/releases/download/v${version}/checksums_hashes_order
@@ -68,15 +68,15 @@ skaffold:
     linux_arm64: df3ca1d83a4be9b7f4795de4470c8274a8420563d2d0d40fbcafbc92bd1b6c8e
 
 helm:
-  version: 3.16.2
+  version: 3.16.3
   templates:
     download: https://get.helm.sh/helm-v${version}-${os}-${arch}.tar.gz
     sha256: https://get.helm.sh/helm-v${version}-${os}-${arch}.tar.gz.sha256sum
   sha256:
-    darwin_amd64: 33efd48492f2358a49a231873e8baf41f702b5ab059333ae9c31e5517633c16e
-    darwin_arm64: 56413c7fbb496d2789881039cab61d849727c7b35db00826fae7a2685a403344
-    linux_amd64: 9318379b847e333460d33d291d4c088156299a26cd93d570a7f5d0c36e50b5bb
-    linux_arm64: 1888301aeb7d08a03b6d9f4d2b73dcd09b89c41577e80e3455c113629fc657a4
+    darwin_amd64: 495d75b404a96fb664f1ca3f8cb01db2210aacc62dbfa1bbab30916abbb20a57
+    darwin_arm64: 3a39f690173086e6eea17674751eb3c8b970c02697e49cecd4093eaa3cf89dcd
+    linux_amd64: f5355c79190951eed23c5432a3b920e071f4c00a64f75e077de0dd4cb7b294ea
+    linux_arm64: 5bd34ed774df6914b323ff84a0a156ea6ff2ba1eaf0113962fa773f3f9def798
   archive:
     tool: tar
     path: ${os}-${arch}/helm
diff --git a/runner.Dockerfile b/runner.Dockerfile
index 4f519ef..cc46cae 100644
--- a/runner.Dockerfile
+++ b/runner.Dockerfile
@@ -10,10 +10,18 @@ RUN set -ex; \
   \
   export DEBIAN_FRONTEND=noninteractive; \
   runDeps='ca-certificates curl git jq unzip findutils patch xz-utils'; \
-  buildDeps=''; \
+  buildDeps='gpg apt-transport-https'; \
   apt-get update && apt-get install -y $runDeps $buildDeps --no-install-recommends; \
   \
-  echo disabled: apt-get purge -y --auto-remove $buildDeps; \
+  echo "workaround for y-helm failing in github actions due to get.helm.sh SSL error"; \
+  curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | tee /usr/share/keyrings/helm.gpg > /dev/null; \
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | tee /etc/apt/sources.list.d/helm-stable-debian.list; \
+  apt-get update && apt-get install -y helm --no-install-recommends; \
+  apt_helm_version=$(/usr/bin/helm version --template '{{.Version}}'); \
+  mkdir -p /usr/local/src/ystack/bin && cp -av /usr/bin/helm /usr/local/src/ystack/bin/y-helm-${apt_helm_version}-bin; \
+  ln -s /usr/local/src/ystack/bin/y-helm-${apt_helm_version}-bin /usr/local/src/ystack/bin/helm; \
+  \
+  apt-get purge -y --auto-remove $buildDeps helm; \
   rm -rf /var/lib/apt/lists/*; \
   rm -rf /var/log/dpkg.log /var/log/alternatives.log /var/log/apt /root/.gnupg