diff --git a/.woodpecker.yaml b/.woodpecker.yaml
index 6df3e67..07ea513 100644
--- a/.woodpecker.yaml
+++ b/.woodpecker.yaml
@@ -5,7 +5,7 @@ steps:
   build-main:
     when:
       branch: main
-    image: woodpeckerci/plugin-docker-buildx:3.0.0
+    image: woodpeckerci/plugin-docker-buildx:3.1.0@sha256:4327ebcb101d5f5a446cc2d83574dfdf54ac75ce4a47bcb254309a5c169830dd
     pull: true
     settings:
       platforms: linux/amd64
@@ -20,7 +20,7 @@ steps:
     when:
       branch:
         exclude: ["main"]
-    image: woodpeckerci/plugin-docker-buildx:3.0.0
+    image: woodpeckerci/plugin-docker-buildx:3.1.0@sha256:4327ebcb101d5f5a446cc2d83574dfdf54ac75ce4a47bcb254309a5c169830dd
     pull: true
     settings:
       platforms: linux/amd64
diff --git a/Dockerfile b/Dockerfile
index 5f3feb9..3d1441b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-FROM python:3.12.1-alpine3.19
-COPY --from=koalaman/shellcheck:v0.9.0 /bin/shellcheck /bin/
+FROM python:3.12.2-alpine3.19@sha256:1a0501213b470de000d8432b3caab9d8de5489e9443c2cc7ccaa6b0aa5c3148e
+COPY --from=koalaman/shellcheck:v0.10.0@sha256:2097951f02e735b613f4a34de20c40f937a6c8f18ecb170612c88c34517221fb /bin/shellcheck /bin/
 
 # renovate: datasource=repology depName=alpine_3_19/build-base versioning=loose
 ENV BUILD_BASE_VERSION="0.5-r3"
@@ -12,7 +12,7 @@ ENV GIT_VERSION="2.43.0-r0"
 # renovate: datasource=repology depName=alpine_3_19/openssh-keygen versioning=loose
 ENV OPENSSH_KEYGEN_VERSION="9.6_p1-r0"
 # renovate: datasource=pypi depName=pre-commit versioning=pep440
-ENV PRE_COMMIT_VERSION="3.6.0"
+ENV PRE_COMMIT_VERSION="3.6.2"
 # renovate: datasource=rubygems depName=mdl versioning=ruby
 ENV MDL_VERSION="0.13.0"