diff --git a/.woodpecker/ansible-lint.yml b/.woodpecker/ansible-lint.yml
index a2b63ad1..d6d5987f 100644
--- a/.woodpecker/ansible-lint.yml
+++ b/.woodpecker/ansible-lint.yml
@@ -3,7 +3,7 @@ depends_on:
   - gitleaks
 steps:
   ansible-lint:
-    image: quay.io/ansible/creator-ee
+    image: quay.io/ansible/creator-ee@sha256:90298d88bc38f057e199523b8143c2c4cf9c159547ef93cf62d8861390c5600a
     commands:
       - ansible-lint --version
       - echo $${VAULTPASS} > ./vault-pass.yml # nach des Secret in Großschreibung
diff --git a/.woodpecker/gitleaks.yml b/.woodpecker/gitleaks.yml
index 3aefe4b9..4876c89a 100644
--- a/.woodpecker/gitleaks.yml
+++ b/.woodpecker/gitleaks.yml
@@ -1,7 +1,7 @@
 ---
 steps:
   gitleaks:
-    image: zricethezav/gitleaks:latest
+    image: zricethezav/gitleaks:latest@sha256:6945c62ca019ead32bc337ab0c9fd055e98d82961765d38b7ccccc84dae95d0f
     commands:
       - gitleaks detect --no-git --verbose --source $CI_WORKSPACE
     when:
diff --git a/docker-compose/routeros-config-export/docker-compose.yml b/docker-compose/routeros-config-export/docker-compose.yml
index 31565a2e..f8996f16 100644
--- a/docker-compose/routeros-config-export/docker-compose.yml
+++ b/docker-compose/routeros-config-export/docker-compose.yml
@@ -3,7 +3,7 @@ services:
   routeros-config-export:
     container_name: routeros-config-export
     restart: always
-    image: registry.mgrote.net/routeros-config-export:master
+    image: registry.mgrote.net/routeros-config-export:master@sha256:2a23f6ae21b55ac39a8ffe5dcb6d3441473e02c6402d68d85e90abfa1ff634cb
     volumes:
       - ./key_rb5009:/key_rb5009:ro
       - ./key_hex:/key_hex:ro