diff --git a/.woodpecker.yaml b/.woodpecker.yaml
index 6df3e67..39c111c 100644
--- a/.woodpecker.yaml
+++ b/.woodpecker.yaml
@@ -5,7 +5,7 @@ steps:
   build-main:
     when:
       branch: main
-    image: woodpeckerci/plugin-docker-buildx:3.0.0
+    image: woodpeckerci/plugin-docker-buildx:3.2.0@sha256:dd271bf14af6e8c95844a62a1ffff356324a2c7508f4b30d279a97cefd4756ff
     pull: true
     settings:
       platforms: linux/amd64
@@ -20,7 +20,7 @@ steps:
     when:
       branch:
         exclude: ["main"]
-    image: woodpeckerci/plugin-docker-buildx:3.0.0
+    image: woodpeckerci/plugin-docker-buildx:3.2.0@sha256:dd271bf14af6e8c95844a62a1ffff356324a2c7508f4b30d279a97cefd4756ff
     pull: true
     settings:
       platforms: linux/amd64
diff --git a/Dockerfile b/Dockerfile
index 5f3feb9..56544f4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-FROM python:3.12.1-alpine3.19
-COPY --from=koalaman/shellcheck:v0.9.0 /bin/shellcheck /bin/
+FROM python:3.12.2-alpine3.19@sha256:25a82f6f8b720a6a257d58e478a0a5517448006e010c85273f4d9c706819478c
+COPY --from=koalaman/shellcheck:v0.10.0@sha256:2097951f02e735b613f4a34de20c40f937a6c8f18ecb170612c88c34517221fb /bin/shellcheck /bin/
 
 # renovate: datasource=repology depName=alpine_3_19/build-base versioning=loose
 ENV BUILD_BASE_VERSION="0.5-r3"
@@ -12,7 +12,7 @@ ENV GIT_VERSION="2.43.0-r0"
 # renovate: datasource=repology depName=alpine_3_19/openssh-keygen versioning=loose
 ENV OPENSSH_KEYGEN_VERSION="9.6_p1-r0"
 # renovate: datasource=pypi depName=pre-commit versioning=pep440
-ENV PRE_COMMIT_VERSION="3.6.0"
+ENV PRE_COMMIT_VERSION="3.7.0"
 # renovate: datasource=rubygems depName=mdl versioning=ruby
 ENV MDL_VERSION="0.13.0"