diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
index f28e492..e0871eb 100644
--- a/.woodpecker/build.yml
+++ b/.woodpecker/build.yml
@@ -3,7 +3,7 @@ depends_on:
   - lint
 steps:
   selfhosted_tag:
-    image: plugins/docker
+    image: plugins/docker@sha256:2f157400c2cb7de1b309b0f044f119375108218e54d38e1340e00b9f93abdefb
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/routeros-config-export
@@ -15,7 +15,7 @@ steps:
         - tag
 
   selfhosted_push:
-    image: plugins/docker
+    image: plugins/docker@sha256:2f157400c2cb7de1b309b0f044f119375108218e54d38e1340e00b9f93abdefb
     settings:
       dockerfile: Dockerfile
       repo: registry.mgrote.net/routeros-config-export
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index 21a75d7..1c3930f 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -10,7 +10,7 @@ steps:
           - tag
 
   hadolint:
-    image: pipelinecomponents/hadolint:0.25.9
+    image: pipelinecomponents/hadolint:0.25.9@sha256:430e949e6554d56ffc2dd08898ee609c71822d7fa1033f7c4dc240e90f2aac23
     commands:
       - hadolint Dockerfile
     when:
@@ -19,7 +19,7 @@ steps:
           - tag
 
   shellcheck:
-    image: koalaman/shellcheck-alpine:stable
+    image: koalaman/shellcheck-alpine:stable@sha256:f73b035c8ebfc8a66ba54e07af5cc41e790cf41fff45317914b1ce677dd9cada
     commands:
       - "find . -name *.sh -exec shellcheck {} +"
     when:
diff --git a/Dockerfile b/Dockerfile
index 48b21c6..1a0eb35 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM alpine:3@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b
 
 # hadolint ignore=DL3018
 RUN apk add --no-cache \