diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index a97364242..2de8d0a1c 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -15,16 +15,16 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Install Go
-        uses: buildjet/setup-go@v5
+        uses: buildjet/setup-go@555ce355a95ff01018ffcf8fbbd9c44654db8374 # v5.0.2
         with:
           go-version: 1.25.x
           cache: false
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
       - name: Post "benchmark running" comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const marker = '<!-- benchstat-report -->';
@@ -64,7 +64,7 @@ jobs:
             }
       - name: Install benchstat
         run: |
-          GOBIN="$PWD/.bin" go install golang.org/x/perf/cmd/benchstat@latest
+          GOBIN="$PWD/.bin" go install golang.org/x/perf/cmd/benchstat@82a0b07e230d76fa1b3036c383d7a98172f87334
           echo "$PWD/.bin" >> "$GITHUB_PATH"
       - name: Prepare base worktree
         run: |
@@ -109,7 +109,7 @@ jobs:
             echo '</details>'
           } > bench-report.md
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: benchmark-results
           path: |
@@ -119,7 +119,7 @@ jobs:
             bench-report.md
           retention-days: 14
       - name: Post report to PR
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 42919bcd5..08465ffd8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: buildjet/setup-go@v5
+      - uses: buildjet/setup-go@555ce355a95ff01018ffcf8fbbd9c44654db8374 # v5.0.2
         with:
           go-version: 1.22.x
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8abc33223..3a333c273 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Enable Pull Request Automerge
         if: steps.cpr.outputs.pull-request-operation == 'created'
-        uses: peter-evans/enable-pull-request-automerge@v3
+        uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3
         with:
           token: ${{ secrets.FLANKBOT }}
           pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a0e83b9a1..844212094 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: buildjet/setup-go@v5
+        uses: buildjet/setup-go@555ce355a95ff01018ffcf8fbbd9c44654db8374 # v5.0.2
         with:
           go-version: 1.22.x
       - name: Checkout code
diff --git a/Dockerfile b/Dockerfile
index 5708d422d..2455c830f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,6 @@
 # syntax=docker/dockerfile:1.3.1-labs
-FROM --platform=linux/amd64 golang:1.26-alpine AS build
+ARG TARGETOS=linux
+FROM --platform=linux/amd64 golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/Dockerfile.integration b/Dockerfile.integration
index c3927b1ad..9a92bd65a 100644
--- a/Dockerfile.integration
+++ b/Dockerfile.integration
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
 
 RUN apk add --no-cache make tzdata