diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml
index 88445d8..7e54864 100644
--- a/.github/workflows/flowzone.yml
+++ b/.github/workflows/flowzone.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   flowzone:
     name: Flowzone
-    uses: product-os/flowzone/.github/workflows/flowzone.yml@v5.3.2
+    uses: product-os/flowzone/.github/workflows/flowzone.yml@c7c803c7e21cc4f75d4d12dc889902e96c8cd5f8 # v5.3.2
     # prevent duplicate workflow executions for pull_request and pull_request_target
     if: |
       (
diff --git a/Dockerfile b/Dockerfile
index 396ac3e..e3f7a42 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.4
 
-FROM alpine:3.18.2 AS build-base
+FROM alpine:3.18.2@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1 AS build-base
 
 ARG TARGETARCH
 
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
index 6f72a62..864cd2c 100644
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -10,7 +10,7 @@ services:
     command: -v -v
 
   sut:
-    image: alpine:3.18
+    image: alpine:3.18@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1
     depends_on:
       - server
     volumes: