diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
index 0c49f26..d055d24 100644
--- a/.woodpecker/build.yml
+++ b/.woodpecker/build.yml
@@ -3,7 +3,7 @@ depends_on:
   - lint
 steps:
   selfhosted_tag:
-    image: plugins/docker
+    image: plugins/docker@sha256:2f157400c2cb7de1b309b0f044f119375108218e54d38e1340e00b9f93abdefb
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/postfix
@@ -15,7 +15,7 @@ steps:
         - tag
 
   selfhosted_push:
-    image: plugins/docker
+    image: plugins/docker@sha256:2f157400c2cb7de1b309b0f044f119375108218e54d38e1340e00b9f93abdefb
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/postfix
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index 21a75d7..1c3930f 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -10,7 +10,7 @@ steps:
           - tag
 
   hadolint:
-    image: pipelinecomponents/hadolint:0.25.9
+    image: pipelinecomponents/hadolint:0.25.9@sha256:430e949e6554d56ffc2dd08898ee609c71822d7fa1033f7c4dc240e90f2aac23
     commands:
       - hadolint Dockerfile
     when:
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: koalaman/shellcheck-alpine:stable
+    image: koalaman/shellcheck-alpine:stable@sha256:f73b035c8ebfc8a66ba54e07af5cc41e790cf41fff45317914b1ce677dd9cada
     commands:
       - "find . -name *.sh -exec shellcheck {} +"
     when:
diff --git a/Dockerfile b/Dockerfile
index 016a0f1..2bb39e8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 #Dockerfile for a Postfix email relay service
-FROM alpine:3
+FROM alpine:3@sha256:51b67269f354137895d43f3b3d810bfacd3945438e94dc5ac55fdac340352f48
 
 COPY run.sh /
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 62f9924..1eb3f31 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,7 @@
 version: '2'
 services:
   postfix:
-    image: juanluisbaptiste/postfix:latest
+    image: juanluisbaptiste/postfix:latest@sha256:4f770a2a6e1957ec45064826b64fbda0d2041729fe27774a7082a7646a63bd63
     expose:
     - "25"
     env_file: