diff --git a/src/dstack/_internal/core/backends/kubernetes/utils.py b/src/dstack/_internal/core/backends/kubernetes/utils.py
index 4a39bf5642..a40e8abcbe 100644
--- a/src/dstack/_internal/core/backends/kubernetes/utils.py
+++ b/src/dstack/_internal/core/backends/kubernetes/utils.py
@@ -185,7 +185,7 @@ def get_context(self, name: Optional[str] = None) -> KubeconfigContext:
 
 
 def kubeconfig_data_to_kubeconfig_dict(kubeconfig_data: str) -> dict:
-    kubeconfig_dict = yaml.load(kubeconfig_data, yaml.FullLoader)
+    kubeconfig_dict = yaml.safe_load(kubeconfig_data)
     if not isinstance(kubeconfig_dict, dict):
         raise TypeError(f"Unexpected kubeconfig_data type: {kubeconfig_dict.__class__.__name__}")
     return kubeconfig_dict
diff --git a/src/dstack/_internal/core/services/repos.py b/src/dstack/_internal/core/services/repos.py
index dd02d93de9..d37de2b212 100644
--- a/src/dstack/_internal/core/services/repos.py
+++ b/src/dstack/_internal/core/services/repos.py
@@ -105,7 +105,7 @@ def get_repo_creds_and_default_branch(
     # token from gh config
     if os.path.exists(gh_config_path):
         with open(gh_config_path, "r") as f:
-            gh_hosts = yaml.load(f, Loader=yaml.FullLoader)
+            gh_hosts = yaml.safe_load(f)
         _oauth_token = gh_hosts.get(url.host, {}).get("oauth_token")
         if _oauth_token is not None:
             with suppress(RepoInvalidCredentialsError):
diff --git a/src/dstack/_internal/server/services/config.py b/src/dstack/_internal/server/services/config.py
index 0bc201677e..f390200695 100644
--- a/src/dstack/_internal/server/services/config.py
+++ b/src/dstack/_internal/server/services/config.py
@@ -220,7 +220,7 @@ def _load_config(self) -> Optional[ServerConfig]:
                 content = f.read()
         except OSError:
             return
-        config_dict = yaml.load(content, yaml.FullLoader)
+        config_dict = yaml.safe_load(content)
         return ServerConfig.parse_obj(config_dict)
 
     def _save_config(self, config: ServerConfig):
@@ -271,7 +271,7 @@ class _BackendConfigWithCreds(CoreModel):
 
 def config_yaml_to_backend_config(config_yaml: str) -> AnyBackendConfigWithCreds:
     try:
-        config_dict = yaml.load(config_yaml, yaml.FullLoader)
+        config_dict = yaml.safe_load(config_yaml)
     except yaml.YAMLError:
         raise ServerClientError("Error parsing YAML")
     try:
diff --git a/src/tests/_internal/cli/commands/test_project.py b/src/tests/_internal/cli/commands/test_project.py
index f022b3d404..7259169df5 100644
--- a/src/tests/_internal/cli/commands/test_project.py
+++ b/src/tests/_internal/cli/commands/test_project.py
@@ -29,7 +29,7 @@ def test_adds_project(self, capsys: CaptureFixture, tmp_path: Path):
             APIClientMock.assert_called_once_with(base_url="http://127.0.0.1:31313", token="token")
             api_client_mock.projects.get.assert_called_with("project")
         assert exit_code == 0
-        assert yaml.load(cli_config_path.read_text(), yaml.FullLoader) == {
+        assert yaml.safe_load(cli_config_path.read_text()) == {
             "projects": [
                 {
                     "default": True,