diff --git a/group_vars/all.yml b/group_vars/all.yml
index 3db59e977f..c84858a644 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -30,14 +30,39 @@ cifmw_default_dns_servers:
   - "1.1.1.1"
   - "8.8.8.8"
 
-# group_vars related to github repo URLs
-cifmw_openstack_k8s_operators_org_url: "https://github.com/openstack-k8s-operators"
-cifmw_repo_url: "{{ cifmw_openstack_k8s_operators_org_url }}/ci-framework"
-cifmw_installyamls_repo_url: "{{ cifmw_openstack_k8s_operators_org_url }}/install_yamls"
-cifmw_architecture_repo_url: "{{ cifmw_openstack_k8s_operators_org_url }}/architecture"
-
 # set to false to enable logging of sensitive data
 cifmw_nolog: true
 
 # Vars for defaults which may change in the future
 cifmw_default_registry: "quay.io"
+
+cifmw_openstack_k8s_operators_org_url: "https://github.com/openstack-k8s-operators"
+
+#### Pinned external projects dependencies ####
+#
+# These variables define the source URL and version for
+# projects that ci-framework can either receive from Zuul (as a
+# required-project checkout) or clone on its own when running
+# outside Zuul or when the projects are not listed in required-projects.
+#
+# Roles reference these variables directly in their tasks.
+# Jobs can override any of them via vars or extra-vars.
+
+# Might be interesting extracting them in a new group_vars/all folder,
+# this require renaming this file to main.yml taking care of regressions
+
+# ci-framework
+cifmw_repo_url: "{{ cifmw_openstack_k8s_operators_org_url }}/ci-framework"
+cifmw_repo_version: "HEAD"
+
+# repo-setup
+cifmw_repo_setup_src: "{{ cifmw_openstack_k8s_operators_org_url }}/repo-setup"
+cifmw_repo_setup_version: "HEAD"
+
+# install_yamls
+cifmw_installyamls_repo_url: "{{ cifmw_openstack_k8s_operators_org_url }}/install_yamls"
+cifmw_install_yamls_version: "HEAD"
+
+# architecture
+cifmw_architecture_repo_url: "{{ cifmw_openstack_k8s_operators_org_url }}/architecture"
+cifmw_kustomize_deploy_architecture_repo_version: "HEAD"
diff --git a/roles/reproducer/tasks/default_repositories.yml b/roles/reproducer/tasks/default_repositories.yml
index 8ca01b682b..0d43e9f083 100644
--- a/roles/reproducer/tasks/default_repositories.yml
+++ b/roles/reproducer/tasks/default_repositories.yml
@@ -7,10 +7,12 @@
       ansible.builtin.stat:
         path: "{{ repository.dest }}"
 
+    # It seems override-checkout is not set anywhere. Not related with its value
+    # in zuul jobs
     - name: "Clone repository if needed: {{ repository.src | basename}}"
       when:
         - not _repo_clone.stat.exists
       ansible.builtin.git:  # noqa: latest[git]
         dest: "{{ repository.dest }}"
         repo: "{{ repository.src }}"
-        version: "{{ repository['override-checkout'] | default(omit) }}"
+        version: "{{ repository['override-checkout'] | default(repository.version | default(omit)) }}"
diff --git a/roles/reproducer/vars/main.yml b/roles/reproducer/vars/main.yml
index 00ebf325c2..bfb67b03d5 100644
--- a/roles/reproducer/vars/main.yml
+++ b/roles/reproducer/vars/main.yml
@@ -1,12 +1,26 @@
 ---
-# Default repositories we always want to have
+# Versions are set at group_vars/all.yml
+# TODO(evallesp): We're setting pull capabilities directly from roles that are required.
+# We might eventually think how to simplify reproducer and let each of the roles to clone
+# repositories. Might be also a good option to use an ansible role for pulling them
+# in the desired moment by cloning it.
+#
+# Precedence chain:
+#    * Zuul repos
+#    * cifmw_reproducer_repositories
+#    * cifmw_reproducer_default_repositories
+#    * Git pull logic in each of the roles
+
 cifmw_reproducer_default_repositories:
   - src: "{{ cifmw_repo_url }}"
     dest: "{{ cifmw_reproducer_controller_user_dir }}/{{ cifmw_repo_relative }}"
+    version: "{{ cifmw_repo_version }}"
   - src: "{{ cifmw_installyamls_repo_url }}"
     dest: "{{ cifmw_reproducer_controller_user_dir }}/{{ cifmw_installyamls_repos_relative }}"
+    version: "{{ cifmw_install_yamls_version }}"
   - src: "{{ cifmw_architecture_repo_url }}"
     dest: "{{ cifmw_reproducer_controller_user_dir }}/{{ cifmw_architecture_repo_relative }}"
+    version: "{{ cifmw_kustomize_deploy_architecture_repo_version }}"
 
 # one place to rule them all
 cifmw_reproducer_nm_dnsmasq: "/etc/NetworkManager/conf.d/zz-dnsmasq.conf"