diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 115baf2..d4617b0 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -9,10 +9,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: '25'
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index b020491..e31ecb4 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -8,10 +8,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: '25'
@@ -35,4 +35,4 @@ jobs:
         run: docker push gitea.seeseepuff.be/seeseemelk/webgit:latest
 
       - name: Trigger Watchtower
-        uses: https://gitea.seeseepuff.be/actions/watchtower@v1
+        uses: https://gitea.seeseepuff.be/actions/watchtower@3c31a0da833fadae874b66f14d5f61980dc4f07b # v1
diff --git a/Dockerfile b/Dockerfile
index 3670456..9bf4c3e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:25-alpine
+FROM eclipse-temurin:25-alpine@sha256:30d9f87d702c2c1c601ed0d31e0c88ea1ea474ee7676cda7b7a59e759181c4dd
 WORKDIR /app
 ADD ./build/libs/webgit-0.0.1-SNAPSHOT.jar /app/webgit.jar
 ENTRYPOINT ["java", "-jar", "webgit.jar"]