diff --git a/Dockerfile b/Dockerfile
index d4b8b4d54..6c3424a64 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.21 as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.21@sha256:7d0dcbe5807b1ad7272a598fbf9d7af15b5e2bed4fd6c4c2b5b3684df0b317dd as builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
@@ -28,7 +28,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} GO111MODUL
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static-debian11:nonroot
+FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static-debian11:nonroot@sha256:f41b84cda410b05cc690c2e33d1973a31c6165a2721e2b5343aab50fecb63441
 WORKDIR /
 COPY --from=builder /workspace/manager .
 ENTRYPOINT ["/manager"]
diff --git a/docs/benchmarks/loadgens/Dockerfile b/docs/benchmarks/loadgens/Dockerfile
index 9a526ca91..e0446042b 100644
--- a/docs/benchmarks/loadgens/Dockerfile
+++ b/docs/benchmarks/loadgens/Dockerfile
@@ -15,7 +15,7 @@ WORKDIR /build/sangrenel
 
 RUN go mod download && go build -o /sangrenel
 
-FROM alpine:3.18
+FROM alpine:3.18@sha256:11e21d7b981a59554b3f822c49f6e9f57b6068bb74f49c4cd5cc4c663c7e5160
 
 RUN apk add --update --no-cache ca-certificates tzdata curl bash
 
diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
index 447b42a1a..38e4de436 100644
--- a/hack/kafka-test-pod/Dockerfile
+++ b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.21 as builder
+FROM golang:1.21@sha256:7d0dcbe5807b1ad7272a598fbf9d7af15b5e2bed4fd6c4c2b5b3684df0b317dd as builder
 
 WORKDIR /workspace