diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
index b63919c..33c8795 100644
--- a/.woodpecker/build.yml
+++ b/.woodpecker/build.yml
@@ -7,7 +7,7 @@ variables: # https://woodpecker-ci.org/docs/usage/advanced-usage
 
 steps:
   docker_build_and_push_selfhosted:
-    image: "woodpeckerci/plugin-docker-buildx:3.0.1"
+    image: "woodpeckerci/plugin-docker-buildx:3.0.1@sha256:c7ac0b01243466bef93863591940ce5eacf59759e9045433a6fc28d20c696d01"
     privileged: true
     settings:
       dockerfile: Dockerfile
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index d9a39e4..001d5c0 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: "koalaman/shellcheck-alpine:latest"
+    image: "koalaman/shellcheck-alpine:latest@sha256:bdcdfa772d6f8c1e9582a1e5c1c0ea1e4de8acdfb79aae2b646367e66410ccca"
     commands:
       - |
         find . -type f -not -path './.git/*' -not -path './collections/*' -exec file {} \; | while IFS= read -r line; do