diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 55667f4..00fc66c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,7 +11,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     container:
-      image: golang:1.20
+      image: golang:1.20@sha256:bc5f0b5e43282627279fe5262ae275fecb3d2eae3b33977a7fd200c7a760d6f1
     steps:
     - name: clone
       uses: actions/checkout@v3
diff --git a/Dockerfile b/Dockerfile
index 1ee4c8a..b925e40 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@
 ##    docker build --no-cache --target certs -t vela-downstream:certs .    ##
 #############################################################################
 
-FROM alpine as certs
+FROM alpine@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1 as certs
 
 RUN apk add --update --no-cache ca-certificates