diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
index cf10fc5..4054682 100644
--- a/.woodpecker/build.yml
+++ b/.woodpecker/build.yml
@@ -7,7 +7,7 @@ variables: # https://woodpecker-ci.org/docs/usage/advanced-usage
 
 steps:
   selfhosted_push:
-    image: "woodpeckerci/plugin-docker-buildx:3.0.1"
+    image: "woodpeckerci/plugin-docker-buildx:3.0.1@sha256:c7ac0b01243466bef93863591940ce5eacf59759e9045433a6fc28d20c696d01"
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/postfix
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index d9a39e4..71ad99d 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: "koalaman/shellcheck-alpine:latest"
+    image: "koalaman/shellcheck-alpine:latest@sha256:7b0682c5786633fc075f69852e5c7521767e8dcb512c43cf8041b022bdc98198"
     commands:
       - |
         find . -type f -not -path './.git/*' -not -path './collections/*' -exec file {} \; | while IFS= read -r line; do