diff --git a/.github/workflows/bash.yml b/.github/workflows/bash.yml
index 0d3de63..9c85b29 100644
--- a/.github/workflows/bash.yml
+++ b/.github/workflows/bash.yml
@@ -15,10 +15,10 @@ jobs:
     
     steps:
     - name: clone
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: docker
-      uses: elgohr/Publish-Docker-Github-Action@v4
+      uses: elgohr/Publish-Docker-Github-Action@742a180fa47f3adfb5115902ae4955acc6ad769b # v4
       with:
         name: target/vela-sample:bash
         workdir: plugins/bash
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 932d55b..67bee22 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -15,10 +15,10 @@ jobs:
     
     steps:
     - name: clone
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: install go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
       with:
         go-version: '>=1.19.0'
 
@@ -34,7 +34,7 @@ jobs:
           plugins/go/main.go
 
     - name: docker
-      uses: elgohr/Publish-Docker-Github-Action@v4
+      uses: elgohr/Publish-Docker-Github-Action@742a180fa47f3adfb5115902ae4955acc6ad769b # v4
       with:
         name: target/vela-sample:go
         workdir: plugins/go
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index 2bbb1f0..681982a 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -15,15 +15,15 @@ jobs:
     
     steps:
     - name: clone
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: install node
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
       with:
         node-version: 16
 
     - name: docker
-      uses: elgohr/Publish-Docker-Github-Action@v4
+      uses: elgohr/Publish-Docker-Github-Action@742a180fa47f3adfb5115902ae4955acc6ad769b # v4
       with:
         name: target/vela-sample:node
         workdir: plugins/node.js
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 9766086..3a14312 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -15,15 +15,15 @@ jobs:
     
     steps:
     - name: clone
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: setup python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
       with:
         python-version: '3.10'
 
     - name: docker
-      uses: elgohr/Publish-Docker-Github-Action@v4
+      uses: elgohr/Publish-Docker-Github-Action@742a180fa47f3adfb5115902ae4955acc6ad769b # v4
       with:
         name: target/vela-sample:python
         workdir: plugins/python
diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index 9519208..d00d5c3 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -15,7 +15,7 @@ jobs:
     
     steps:
     - name: clone
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: setup ruby
       uses: ruby/setup-ruby@v1
@@ -23,7 +23,7 @@ jobs:
         ruby-version: '3.0'
 
     - name: docker
-      uses: elgohr/Publish-Docker-Github-Action@v4
+      uses: elgohr/Publish-Docker-Github-Action@742a180fa47f3adfb5115902ae4955acc6ad769b # v4
       with:
         name: target/vela-sample:ruby
         workdir: plugins/ruby
diff --git a/plugins/bash/Dockerfile b/plugins/bash/Dockerfile
index 9a6b0ea..4d422fe 100644
--- a/plugins/bash/Dockerfile
+++ b/plugins/bash/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine
+FROM alpine@sha256:7eccd4d5d574a3c889b0a6d97b2cdd0308c8e1afc2bba8d467c2b87d879b0c1c
 
 RUN apk add --update --no-cache bash ca-certificates curl
 
diff --git a/plugins/go/Dockerfile b/plugins/go/Dockerfile
index 920640b..bece69f 100644
--- a/plugins/go/Dockerfile
+++ b/plugins/go/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:alpine
+FROM golang:alpine@sha256:ac67716dd016429be8d4c2c53a248d7bcdf06d34127d3dc451bda6aa5a87bc06
 
 RUN apk add --update --no-cache ca-certificates
 
diff --git a/plugins/node.js/Dockerfile b/plugins/node.js/Dockerfile
index 7fb13a1..e0469be 100644
--- a/plugins/node.js/Dockerfile
+++ b/plugins/node.js/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:alpine
+FROM node:alpine@sha256:c9bb43423a6229aeddf3d16ae6aaa0ff71a0b2951ce18ec8fedb6f5d766cf286
 
 RUN apk add --update --no-cache ca-certificates
 
diff --git a/plugins/python/Dockerfile b/plugins/python/Dockerfile
index a05dc73..afccee5 100644
--- a/plugins/python/Dockerfile
+++ b/plugins/python/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:alpine
+FROM python:alpine@sha256:7130f75b1bb16c7c5d802782131b4024fe3d7a87ce7d936e8948c2d2e0180bc4
 
 RUN apk add --update --no-cache ca-certificates
 
diff --git a/plugins/ruby/Dockerfile b/plugins/ruby/Dockerfile
index 69ff5a8..01ccc5d 100644
--- a/plugins/ruby/Dockerfile
+++ b/plugins/ruby/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:alpine
+FROM ruby:alpine@sha256:0bf4169697f44df52cea27b0ceb1a3b715b168625b7c404202e2dfe31dee25e2
 
 RUN apk add --update --no-cache ca-certificates