diff --git a/Dockerfile b/Dockerfile
index d4b8b4d545..df766c34b1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.21 as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.21@sha256:c82d4ad02c062cf2b393bf0374df26638c6fed3dfe52cdbd3635d4a7befab86e as builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
@@ -28,7 +28,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} GO111MODUL
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static-debian11:nonroot
+FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static-debian11:nonroot@sha256:49af06135e8bbe8ddc46c1d28b0bd00961aae9c9ed090bbc0237f58e1462dd4b
 WORKDIR /
 COPY --from=builder /workspace/manager .
 ENTRYPOINT ["/manager"]
diff --git a/docs/benchmarks/loadgens/Dockerfile b/docs/benchmarks/loadgens/Dockerfile
index 9a526ca91d..e0446042b7 100644
--- a/docs/benchmarks/loadgens/Dockerfile
+++ b/docs/benchmarks/loadgens/Dockerfile
@@ -15,7 +15,7 @@ WORKDIR /build/sangrenel
 
 RUN go mod download && go build -o /sangrenel
 
-FROM alpine:3.18
+FROM alpine:3.18@sha256:11e21d7b981a59554b3f822c49f6e9f57b6068bb74f49c4cd5cc4c663c7e5160
 
 RUN apk add --update --no-cache ca-certificates tzdata curl bash
 
diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
index 447b42a1a8..a228e33dc7 100644
--- a/hack/kafka-test-pod/Dockerfile
+++ b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.21 as builder
+FROM golang:1.21@sha256:c82d4ad02c062cf2b393bf0374df26638c6fed3dfe52cdbd3635d4a7befab86e as builder
 
 WORKDIR /workspace