diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0546a11..900b224 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: ./inkbridge
           file: ./inkbridge/Dockerfile
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 737faef..a39f88f 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -50,7 +50,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
           working-directory: inkbridge
 
diff --git a/Dockerfile b/Dockerfile
index fb84d43..1f17290 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/home-assistant/devcontainer:4-apps
+FROM ghcr.io/home-assistant/devcontainer:4-apps@sha256:1a1d3c3f1e770ae32620e2711c8925c124d78745e8e36fcf1aface661f86aab0
 
 # renovate: datasource=docker depName=golang versioning=semver
 ARG GO_VERSION=1.26.2
diff --git a/inkbridge/Dockerfile b/inkbridge/Dockerfile
index d6449ae..c7b8f21 100644
--- a/inkbridge/Dockerfile
+++ b/inkbridge/Dockerfile
@@ -10,7 +10,7 @@ COPY cmd ./cmd
 COPY internal ./internal
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$(go env GOARCH) go build -o /out/inkbridge ./cmd/inkbridge
 
-FROM debian:trixie-slim
+FROM debian:trixie-slim@sha256:4ffb3a1511099754cddc70eb1b12e50ffdb67619aa0ab6c13fcd800a78ef7c7a
 
 ARG VERSION
 ARG ARCH