diff --git a/lib/datasource/github/index.js b/lib/datasource/github/index.js
index 74f1afa9c89f2041d5f883e87d4b05446860ecd7..60ce84a41882d1c4dc75195126eadfc9b7bada9e 100644
--- a/lib/datasource/github/index.js
+++ b/lib/datasource/github/index.js
@@ -63,7 +63,42 @@ function getCacheKey(repo, type) {
  * This function will simply return the latest commit hash for the configured repository.
  */
 
-async function getDigest({ lookupName: githubRepo }) {
+async function getTagCommit(githubRepo, tag) {
+  const cachedResult = await renovateCache.get(
+    cacheNamespace,
+    getCacheKey(githubRepo, `tag-${tag}`)
+  );
+  // istanbul ignore if
+  if (cachedResult) {
+    return cachedResult;
+  }
+  let digest;
+  try {
+    const url = `https://api.github.com/repos/${githubRepo}/git/refs/tags/${tag}`;
+    digest = (await ghGot(url)).body.object.sha;
+  } catch (err) {
+    logger.info(
+      { githubRepo, err },
+      'Error getting tag commit from GitHub repo'
+    );
+  }
+  if (!digest) {
+    return null;
+  }
+  const cacheMinutes = 120;
+  await renovateCache.set(
+    cacheNamespace,
+    getCacheKey(githubRepo, `tag-${tag}`),
+    digest,
+    cacheMinutes
+  );
+  return digest;
+}
+
+async function getDigest({ lookupName: githubRepo }, newValue) {
+  if (newValue && newValue.length) {
+    return getTagCommit(githubRepo, newValue);
+  }
   const cachedResult = await renovateCache.get(
     cacheNamespace,
     getCacheKey(githubRepo, 'commit')
diff --git a/lib/datasource/go/index.js b/lib/datasource/go/index.js
index 3f251f5945db88440d8a63695747332ead3d54b1..83843c1197b43c51695fa61771e1d87f41db3f45 100644
--- a/lib/datasource/go/index.js
+++ b/lib/datasource/go/index.js
@@ -95,10 +95,12 @@ async function getPkgReleases({ lookupName }) {
  *  - Call the respective getDigest in github to retrieve the commit hash
  */
 
-async function getDigest({ lookupName }) {
+async function getDigest({ lookupName }, value) {
   const source = await getDatasource(lookupName);
   if (source && source.datasource === 'github') {
-    const digest = await github.getDigest(source);
+    // ignore v0.0.0- pseudo versions that are used Go Modules - look up default branch instead
+    const tag = value && !value.startsWith('v0.0.0-2') ? value : undefined;
+    const digest = await github.getDigest(source, tag);
     return digest;
   }
   return null;
diff --git a/lib/manager/bazel/update.js b/lib/manager/bazel/update.js
index d730bcc9061103710eb15fde61ddf8e13a360079..f1ed91f97a1cc63dec69bcc3f91e757c9a9aa432 100644
--- a/lib/manager/bazel/update.js
+++ b/lib/manager/bazel/update.js
@@ -18,8 +18,8 @@ async function updateDependency(fileContent, upgrade) {
         .replace(/commit = "[^"]+"/, `commit = "${upgrade.newDigest}"`);
       if (upgrade.currentDigest && upgrade.updateType !== 'digest') {
         newDef = newDef.replace(
-          /commit = "[^"]+"/,
-          `tag = "${upgrade.newValue}"`
+          /commit = "[^"]+".*?\n/,
+          `commit = "${upgrade.newDigest}", # ${upgrade.newValue}\n`
         );
       }
     } else if (upgrade.depType === 'http_archive') {
diff --git a/test/datasource/github.spec.js b/test/datasource/github.spec.js
index c4635ab465f584ad2a8e3aa41aaf7ad2654cf9c3..73b89a762718ae3e7e4f443ac3526a04ca5ceacc 100644
--- a/test/datasource/github.spec.js
+++ b/test/datasource/github.spec.js
@@ -32,6 +32,22 @@ describe('datasource/github', () => {
       );
       expect(res).toBe('abcdef');
     });
+    it('returns tagged digest', async () => {
+      ghGot.mockReturnValueOnce({ body: { object: { sha: 'ddd111' } } });
+      const res = await github.getDigest(
+        { depName: 'some-dep', lookupName: 'some/dep' },
+        'v1.2.0'
+      );
+      expect(res).toBe('ddd111');
+    });
+    it('returns null for missed tagged digest', async () => {
+      ghGot.mockReturnValueOnce({});
+      const res = await github.getDigest(
+        { depName: 'some-dep', lookupName: 'some/dep' },
+        'v1.2.0'
+      );
+      expect(res).toBe(null);
+    });
   });
   describe('getPreset()', () => {
     it('tries default then renovate', async () => {
diff --git a/test/manager/bazel/__snapshots__/update.spec.js.snap b/test/manager/bazel/__snapshots__/update.spec.js.snap
index 40bcadda139bd5e0b87505d567abdeb191820c47..deed3d03030698c460e606f57bb6c093f6a97535 100644
--- a/test/manager/bazel/__snapshots__/update.spec.js.snap
+++ b/test/manager/bazel/__snapshots__/update.spec.js.snap
@@ -13,7 +13,7 @@ go_repository(
 go_repository(
     name = \\"com_github_google_uuid\\",
     importpath = \\"github.com/google/uuid\\",
-    tag = \\"v1.0.3\\"
+    commit = \\"aaa09d789f3dba190787f8b4454c7d3c936fe123\\", # v1.0.3
 )
 
 go_repository(
diff --git a/test/manager/bazel/update.spec.js b/test/manager/bazel/update.spec.js
index 07d2bc0312ce0ddfb110598bb455d07322438e2d..93c99f6397ffb29d5a4020d2f8a79ce5c6f822a1 100644
--- a/test/manager/bazel/update.spec.js
+++ b/test/manager/bazel/update.spec.js
@@ -43,13 +43,16 @@ describe('manager/bazel/update', () => {
 `,
         currentValue: 'v0.0.0',
         currentDigest: 'dec09d789f3dba190787f8b4454c7d3c936fed9e',
+        newDigest: 'aaa09d789f3dba190787f8b4454c7d3c936fe123',
         newValue: 'v1.0.3',
         updateType: 'major',
       };
       const res = await bazelfile.updateDependency(content, upgrade);
       expect(res).toMatchSnapshot();
       expect(res).not.toEqual(content);
-      expect(res.includes('tag = "v1.0.3"')).toBe(true);
+      expect(
+        res.includes('"aaa09d789f3dba190787f8b4454c7d3c936fe123", # v1.0.3')
+      ).toBe(true);
     });
     it('updates http archive', async () => {
       const upgrade = {