diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
index d347e5e..adb9d04 100644
--- a/.woodpecker/build.yml
+++ b/.woodpecker/build.yml
@@ -7,7 +7,7 @@ variables: # https://woodpecker-ci.org/docs/usage/advanced-usage
 
 steps:
   selfhosted_push:
-    image: "woodpeckerci/plugin-docker-buildx:3.0.1"
+    image: "woodpeckerci/plugin-docker-buildx:3.0.1@sha256:c7ac0b01243466bef93863591940ce5eacf59759e9045433a6fc28d20c696d01"
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/httpd
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index d9a39e4..001d5c0 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: "koalaman/shellcheck-alpine:latest"
+    image: "koalaman/shellcheck-alpine:latest@sha256:bdcdfa772d6f8c1e9582a1e5c1c0ea1e4de8acdfb79aae2b646367e66410ccca"
     commands:
       - |
         find . -type f -not -path './.git/*' -not -path './collections/*' -exec file {} \; | while IFS= read -r line; do
diff --git a/Dockerfile b/Dockerfile
index 4144570..9e215ee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM httpd:2.4.58-alpine
+FROM httpd:2.4.58-alpine@sha256:5f3c87973b3e76601b2f4d8832d6075e272868815e4966d2e57823591f8da29f
 
 # renovate: datasource=repology depName=alpine_3_19/curl versioning=loose
 ENV CURL_VERSION="8.5.0-r0"