diff --git a/docker-compose/navidrome/docker-compose.yml.j2 b/docker-compose/navidrome/docker-compose.yml.j2
index eca46b3f..f9cf7b76 100644
--- a/docker-compose/navidrome/docker-compose.yml.j2
+++ b/docker-compose/navidrome/docker-compose.yml.j2
@@ -3,7 +3,7 @@ services:
 ######## navidrome-mg ########
   navidrome-mg:
     container_name: "navidrome-mg"
-    image: deluan/navidrome:0.51.0
+    image: deluan/navidrome:0.51.0@sha256:efd0b899e74db3e5063a8c773cfe7d103b0b61ce7021a50f2f9da189591b9dc7
     restart: always
     environment:
       ND_LOGLEVEL: info
diff --git a/docker-compose/watchtower/docker-compose.yml.j2 b/docker-compose/watchtower/docker-compose.yml.j2
index b33c4273..ca18bacd 100644
--- a/docker-compose/watchtower/docker-compose.yml.j2
+++ b/docker-compose/watchtower/docker-compose.yml.j2
@@ -3,7 +3,7 @@ services:
   watchtower:
     restart: always
     container_name: watchtower
-    image: containrrr/watchtower
+    image: containrrr/watchtower@sha256:6dd50763bbd632a83cb154d5451700530d1e44200b268a4e9488fefdfcf2b038
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
diff --git a/docker-compose/wiki/docker-compose.yml.j2 b/docker-compose/wiki/docker-compose.yml.j2
index 2513826a..004e60d4 100644
--- a/docker-compose/wiki/docker-compose.yml.j2
+++ b/docker-compose/wiki/docker-compose.yml.j2
@@ -2,7 +2,7 @@ version: '3'
 services:
   wiki-webserver:
     container_name: wiki-webserver
-    image: httpd:2.4
+    image: httpd:2.4@sha256:ba846154ade27292d216cce2d21f1c7e589f3b66a4a643bff0cdd348efd17aa3
     restart: always
     networks:
       - traefik
diff --git a/friedhof/lldap/docker-compose.yml.j2 b/friedhof/lldap/docker-compose.yml.j2
index 494aa39d..a517a572 100644
--- a/friedhof/lldap/docker-compose.yml.j2
+++ b/friedhof/lldap/docker-compose.yml.j2
@@ -2,7 +2,7 @@ version: "3"
 services:
 ######## App ########
   lldap:
-    image: nitnelave/lldap:stable
+    image: nitnelave/lldap:stable@sha256:f0f5d92cd6c6dca9415993cfc57919f0618e87090b323a98c1536975860fa45a
     container_name: lldap-app
     restart: always
     ports:
@@ -42,7 +42,7 @@ services:
       - com.centurylinklabs.watchtower.depends-on=lldap-db
 ######## DB ########
   lldap-db:
-    image: mariadb:10
+    image: mariadb:10@sha256:692856b1f36a6e824ff8b8e78929643c90faa5f0931d74425eed52b09e8ac37b
     container_name: lldap-db
     restart: always
     volumes: