diff --git a/hack/build.sh b/hack/build.sh
index 6cafb5768..9cbb80fce 100755
--- a/hack/build.sh
+++ b/hack/build.sh
@@ -15,6 +15,8 @@
 # limitations under the License.
 
 set -o pipefail
+set -o errexit
+set -o nounset
 
 source_dirs="cmd pkg test lib tools"
 
@@ -25,7 +27,9 @@ else
     ARGS=("$@")
 fi
 
-set -eu
+# Tool version
+readonly GOIMPORTS_VERSION="v0.7.0"
+readonly GOLINT_VERSION="v1.52.0"
 
 # Run build
 run() {
@@ -110,19 +114,19 @@ codegen() {
 
 go_fmt() {
   echo "🧹 ${S}Format"
-  find $(echo $source_dirs) -name "*.go" -print0 | xargs -0 gofmt -s -w
+  find $(echo "$source_dirs") -name "*.go" -print0 | xargs -0 gofmt -s -w
 }
 
 source_format() {
   set +e
-  run_go_tool golang.org/x/tools/cmd/goimports goimports -w $(echo $source_dirs)
-  find $(echo $source_dirs) -name "*.go" -print0 | xargs -0 gofmt -s -w
+  go_run "golang.org/x/tools/cmd/goimports@${GOIMPORTS_VERSION}" -w $(echo "$source_dirs")
+  find $(echo "$source_dirs") -name "*.go" -print0 | xargs -0 gofmt -s -w
   set -e
 }
 
 source_lint() {
   echo "🔍 Lint"
-  run_go_tool github.com/golangci/golangci-lint/cmd/golangci-lint golangci-lint run  || \
+  go_run "github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLINT_VERSION}" run  || \
   { echo "--- FAIL: golangci-lint failed please fix the reported errors"; return 1; }
 }