diff --git a/.woodpecker.yaml b/.woodpecker.yaml
index 6df3e67..8b1cf55 100644
--- a/.woodpecker.yaml
+++ b/.woodpecker.yaml
@@ -5,7 +5,7 @@ steps:
   build-main:
     when:
       branch: main
-    image: woodpeckerci/plugin-docker-buildx:3.0.0
+    image: woodpeckerci/plugin-docker-buildx:3.0.1@sha256:c7ac0b01243466bef93863591940ce5eacf59759e9045433a6fc28d20c696d01
     pull: true
     settings:
       platforms: linux/amd64
@@ -20,7 +20,7 @@ steps:
     when:
       branch:
         exclude: ["main"]
-    image: woodpeckerci/plugin-docker-buildx:3.0.0
+    image: woodpeckerci/plugin-docker-buildx:3.0.1@sha256:c7ac0b01243466bef93863591940ce5eacf59759e9045433a6fc28d20c696d01
     pull: true
     settings:
       platforms: linux/amd64
diff --git a/Dockerfile b/Dockerfile
index 5f3feb9..899f0e3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-FROM python:3.12.1-alpine3.19
-COPY --from=koalaman/shellcheck:v0.9.0 /bin/shellcheck /bin/
+FROM python:3.12.1-alpine3.19@sha256:14cfc61fc2404da8adc7b1cb1fcb299aefafab22ae571f652527184fbb21ce69
+COPY --from=koalaman/shellcheck:v0.9.0@sha256:f35e8987b02760d4e76fc99a68ad5c42cc10bb32f3dd2143a3cf92f1e5446a45 /bin/shellcheck /bin/
 
 # renovate: datasource=repology depName=alpine_3_19/build-base versioning=loose
 ENV BUILD_BASE_VERSION="0.5-r3"