diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 37ff423..8d7055f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,6 @@ jobs:
     steps:
       - name: Install apt-get
         run: sudo apt-get install -y clang llvm
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Build
         run: cargo build --features=${{ matrix.version }} --verbose
diff --git a/.github/workflows/clippy.yml b/.github/workflows/clippy.yml
index 1813c3f..7c30a59 100644
--- a/.github/workflows/clippy.yml
+++ b/.github/workflows/clippy.yml
@@ -13,7 +13,7 @@ jobs:
       matrix:
         version: [community, enterprise]
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1
       - run: rustup component add clippy
       - uses: actions-rs/clippy-check@v1
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0e6ca29..3840d29 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ jobs:
         with:
             toolchain: nightly
             components: rustfmt, clippy
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Run tests
         run: cargo test --features=${{ matrix.version }} --verbose
       - name: Run tests with Couchbase Lite C leak check
diff --git a/Dockerfile b/Dockerfile
index 0eaa434..6fa70a3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=amd64 rust AS strip-stage
+FROM --platform=amd64 rust@sha256:5e33ae75f40bf25854fa86e33487f47075016d16726355a72171f67362ad6bf7 AS strip-stage
 ARG DIRNAME
 RUN apt-get update
 RUN apt-get -y install binutils binutils-aarch64-linux-gnu