diff --git a/.github/workflows/reuse.yaml b/.github/workflows/reuse.yaml
index c27f8f4..1cb746e 100644
--- a/.github/workflows/reuse.yaml
+++ b/.github/workflows/reuse.yaml
@@ -6,6 +6,6 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@v5
\ No newline at end of file
+        uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 18d8b43..ace6340 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # Use distroless as minimal base image to package the component binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:c0f429e16b13e583da7e5a6ec20dd656d325d88e6819cafe0adb0828976529dc
 ARG TARGETOS
 ARG TARGETARCH
 ARG COMPONENT