diff --git a/pungi/ostree/utils.py b/pungi/ostree/utils.py
index 06494dfa..817e74f3 100644
--- a/pungi/ostree/utils.py
+++ b/pungi/ostree/utils.py
@@ -81,7 +81,7 @@ def tweak_treeconf(treeconf, source_repos=None, keep_original_sources=False, upd
         # rpm-ostree now supports YAML, but we'll end up converting it to JSON.
         # https://github.com/projectatomic/rpm-ostree/pull/1377
         if treeconf.endswith('.yaml'):
-            treeconf_content = yaml.load(f)
+            treeconf_content = yaml.safe_load(f)
             treeconf = treeconf.replace('.yaml', '.json')
         else:
             treeconf_content = json.load(f)
diff --git a/tests/test_ostree_script.py b/tests/test_ostree_script.py
index 920ed2da..9aa569a3 100644
--- a/tests/test_ostree_script.py
+++ b/tests/test_ostree_script.py
@@ -165,7 +165,7 @@ class OstreeTreeScriptTest(helpers.PungiTestCase):
 
         with open(treefile, 'r') as f:
             # Read initial content from YAML file
-            treefile_content = yaml.load(f)
+            treefile_content = yaml.safe_load(f)
         original_repos = treefile_content['repos']
         original_ref = treefile_content['ref']
         replacing_ref = original_ref + '-changed'