diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 9f476a8..539d185 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -83,7 +83,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           pull: true
@@ -103,7 +103,7 @@ jobs:
         run: docker run --rm -i "$TEST_TAG" which composer install-php-extensions clevyr-build
 
       - name: Build and Push (base)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           pull: true
@@ -119,7 +119,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Build and Push (onbuild)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: ${{ github.ref_name == 'main' }}