diff --git a/Dockerfile b/Dockerfile
index 2411b40830..223bf630d4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/node:26-alpine AS web
+FROM public.ecr.aws/docker/library/node:26-alpine@sha256:233761595746769ebfdb6090f44fc7cdf818ae0ce62d2b37e0367723b9823e36 AS web
 
 WORKDIR /app
 COPY web/package.json web/pnpm-lock.yaml web/pnpm-workspace.yaml ./
@@ -7,7 +7,7 @@ RUN pnpm install --ignore-scripts --frozen-lockfile
 COPY web/ .
 RUN pnpm build
 
-FROM public.ecr.aws/docker/library/rust:1 AS chef
+FROM public.ecr.aws/docker/library/rust:1@sha256:1bcff4befb740599103a2c7cb51058e14479b2e35e3a34a3f0dc4ede09927488 AS chef
 
 WORKDIR /build
 
@@ -46,7 +46,7 @@ COPY migrations migrations
 RUN cargo install --locked --bin defguard --path ./crates/defguard --root /build
 
 # run
-FROM public.ecr.aws/docker/library/debian:13-slim
+FROM public.ecr.aws/docker/library/debian:13-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
 # TEMPORARY FIX: The parent image has a snapshot of debian sources that has a security vulnerability. This is a temporary fix until the parent image is updated.
 # Remove this once the parent image is updated with the latest debian sources.
 RUN sed -i \
diff --git a/Dockerfile.device b/Dockerfile.device
index e995cacb60..5b6a6a3f31 100644
--- a/Dockerfile.device
+++ b/Dockerfile.device
@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add wireguard-tools && echo wireguard >> /etc/modules
 RUN printf "[Interface]\n\
diff --git a/Dockerfile.ldap b/Dockerfile.ldap
index 5086b40028..3c49942b65 100644
--- a/Dockerfile.ldap
+++ b/Dockerfile.ldap
@@ -1,3 +1,3 @@
-FROM osixia/openldap:1.5.0 as runtime
+FROM osixia/openldap:1.5.0@sha256:18742e9c449c9c1afe129d3f2f3ee15fb34cc43e5f940a20f3399728f41d7c28 as runtime
 # load ldifs
 COPY ./ldif /container/service/slapd/assets/config/bootstrap/ldif/custom
diff --git a/docker-compose.e2e-auto-adoption.yaml b/docker-compose.e2e-auto-adoption.yaml
index 9452f27697..212ca19fd8 100644
--- a/docker-compose.e2e-auto-adoption.yaml
+++ b/docker-compose.e2e-auto-adoption.yaml
@@ -21,7 +21,7 @@ services:
       - db
 
   db:
-    image: public.ecr.aws/docker/library/postgres:11-alpine
+    image: public.ecr.aws/docker/library/postgres:11-alpine@sha256:ea50b9fd617b66c9135816a4536cf6e0697d4eea7014a7194479c95f6edd5ef9
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard
diff --git a/docker-compose.e2e.yaml b/docker-compose.e2e.yaml
index 2bc9e1dbf1..ba59070fd4 100644
--- a/docker-compose.e2e.yaml
+++ b/docker-compose.e2e.yaml
@@ -21,7 +21,7 @@ services:
       - db
 
   db:
-    image: public.ecr.aws/docker/library/postgres:11-alpine
+    image: public.ecr.aws/docker/library/postgres:11-alpine@sha256:ea50b9fd617b66c9135816a4536cf6e0697d4eea7014a7194479c95f6edd5ef9
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard
diff --git a/docker-compose.ldap-test.yaml b/docker-compose.ldap-test.yaml
index 0c5f55527d..dabc391b27 100644
--- a/docker-compose.ldap-test.yaml
+++ b/docker-compose.ldap-test.yaml
@@ -4,7 +4,7 @@
 # Used by `just test-ldap` (locally) and the test-ldap CI job.
 services:
   db:
-    image: public.ecr.aws/docker/library/postgres:17-alpine
+    image: public.ecr.aws/docker/library/postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard
diff --git a/docker-compose.ldap.yaml b/docker-compose.ldap.yaml
index 309e057830..b38df2b3bc 100644
--- a/docker-compose.ldap.yaml
+++ b/docker-compose.ldap.yaml
@@ -32,7 +32,7 @@ services:
       - NET_ADMIN
 
   db:
-    image: postgres:17-alpine
+    image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard
@@ -66,7 +66,7 @@ services:
   #     - ./configs/logstash.conf:/usr/share/logstash/pipeline/logstash.conf:ro
 
   openldap:
-    image: bitnamilegacy/openldap:2.6
+    image: bitnamilegacy/openldap:2.6@sha256:687f14a22b5c74fb057a57221acdbe7b8c82e2d3619fc380db3af48ec4aa04ed
     user: root
     restart: unless-stopped
     environment:
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 24e4b2c012..d7707b53c2 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -41,7 +41,7 @@ services:
       RUST_BACKTRACE: 1
 
   db:
-    image: postgres:17-alpine
+    image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard