diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
index e198e66..3107a5d 100644
--- a/.woodpecker/build.yml
+++ b/.woodpecker/build.yml
@@ -3,7 +3,7 @@ depends_on:
   - lint
 steps:
   selfhosted_tag:
-    image: plugins/docker
+    image: plugins/docker@sha256:2f157400c2cb7de1b309b0f044f119375108218e54d38e1340e00b9f93abdefb
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/nextcloud-cronjob
@@ -15,7 +15,7 @@ steps:
         - tag
 
   selfhosted_push:
-    image: plugins/docker
+    image: plugins/docker@sha256:2f157400c2cb7de1b309b0f044f119375108218e54d38e1340e00b9f93abdefb
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/nextcloud-cronjob
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index aca34a3..b642210 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -1,7 +1,7 @@
 ---
 steps:
   gitleaks:
-    image: zricethezav/gitleaks:v8.18.0
+    image: zricethezav/gitleaks:v8.18.0@sha256:e5f6d1a62786affd1abd882ecc73e9353ce78adea1650711f6e351767723712d
     commands:
       - gitleaks detect --no-git --verbose --source $CI_WORKSPACE
     when:
@@ -10,7 +10,7 @@ steps:
           - tag
 
   hadolint:
-    image: pipelinecomponents/hadolint:0.25.9
+    image: pipelinecomponents/hadolint:0.25.9@sha256:430e949e6554d56ffc2dd08898ee609c71822d7fa1033f7c4dc240e90f2aac23
     commands:
       - hadolint Dockerfile
     when:
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: koalaman/shellcheck-alpine:stable
+    image: koalaman/shellcheck-alpine:stable@sha256:f73b035c8ebfc8a66ba54e07af5cc41e790cf41fff45317914b1ce677dd9cada
     commands:
       - "find . -name *.sh -exec shellcheck -x {} +"
     when:
diff --git a/Dockerfile b/Dockerfile
index c8cc17a..d1bead7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM alpine:3@sha256:51b67269f354137895d43f3b3d810bfacd3945438e94dc5ac55fdac340352f48
 
 # hadolint ignore=DL3018
 RUN apk add --no-cache docker-cli bash tini