diff --git a/.github/workflows/release-devcontainer.yml b/.github/workflows/release-devcontainer.yml
index 98d49c9..c78c0f2 100644
--- a/.github/workflows/release-devcontainer.yml
+++ b/.github/workflows/release-devcontainer.yml
@@ -23,9 +23,9 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build and push Docker image (multi-arch)
-        uses: RevoTale/docker-multi-arch-release-action@v1.4.0
+        uses: RevoTale/docker-multi-arch-release-action@139a43ddaa10e2a91bbdb8f44d4af4e9bcaa5993 # v1.4.0
         with:
           registry: ${{ env.REGISTRY }}
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/release-imgproxy.yml b/.github/workflows/release-imgproxy.yml
index 3443318..1d40781 100644
--- a/.github/workflows/release-imgproxy.yml
+++ b/.github/workflows/release-imgproxy.yml
@@ -19,9 +19,9 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build and push Docker image (multi-arch)
-        uses: RevoTale/docker-multi-arch-release-action@v1.4.0
+        uses: RevoTale/docker-multi-arch-release-action@139a43ddaa10e2a91bbdb8f44d4af4e9bcaa5993 # v1.4.0
         with:
           registry: ${{ env.REGISTRY }}
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/release-nginx.yml b/.github/workflows/release-nginx.yml
index 798ef96..0a4f47a 100644
--- a/.github/workflows/release-nginx.yml
+++ b/.github/workflows/release-nginx.yml
@@ -23,9 +23,9 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build and push Docker image (multi-arch)
-        uses: RevoTale/docker-multi-arch-release-action@v1.4.0
+        uses: RevoTale/docker-multi-arch-release-action@139a43ddaa10e2a91bbdb8f44d4af4e9bcaa5993 # v1.4.0
         with:
           registry: ${{ env.REGISTRY }}
           platforms: linux/amd64,linux/arm64
diff --git a/devcontainer/Dockerfile b/devcontainer/Dockerfile
index 2beac99..8bc3af2 100644
--- a/devcontainer/Dockerfile
+++ b/devcontainer/Dockerfile
@@ -1,5 +1,5 @@
-FROM ghcr.io/biomejs/biome:latest AS biome
+FROM ghcr.io/biomejs/biome:latest@sha256:ba1442675a3e76d8db9eef770b0912e16826ee1f48d63a3a506c000bc33b64ac AS biome
 
-FROM mcr.microsoft.com/vscode/devcontainers/base
+FROM mcr.microsoft.com/vscode/devcontainers/base@sha256:b8c3669fb4cc652621b3386517c40ab3e151e827de958d6fe75528798ffb5727
 
 COPY --from=biome /usr/local/bin/biome /usr/local/bin/biome
diff --git a/nginx/Dockerfile b/nginx/Dockerfile
index b4b8ed6..65332ff 100644
--- a/nginx/Dockerfile
+++ b/nginx/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.27-alpine AS routesgen-builder
+FROM --platform=$BUILDPLATFORM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS routesgen-builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -13,7 +13,7 @@ COPY internal/ ./internal/
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/routesgen ./cmd/routesgen
 
-FROM nginx:1.31-alpine
+FROM nginx:1.31-alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913
 
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY includes/ /etc/nginx/includes/