diff --git a/Dockerfile b/Dockerfile
index 67a80a5..4d401c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM rust:1.80-alpine3.20 AS chef
+FROM rust:1.80-alpine3.20@sha256:596c7fa13f7458097b8c88ad83f33420da0341e2f5b544e34d9aa18a22fe11d0 AS chef
 ENV RUSTFLAGS="-C target-feature=-crt-static"
 RUN apk add --no-cache openssl-dev musl-dev
 RUN cargo install cargo-chef
@@ -18,7 +18,7 @@ COPY --from=dependencies /usr/src/kon/target /usr/src/kon/target
 COPY . .
 RUN cargo build -rF production
 
-FROM alpine:3.20
+FROM alpine:3.20@sha256:0a4eaa0eecf5f8c050e5bba433f58c052be7587ee8af3e8b3910ef9ab5fbe9f5
 RUN apk add --no-cache libgcc fluidsynth
 WORKDIR /kon
 COPY --from=builder /usr/src/kon/target/release/kon .
diff --git a/docker-compose.yml b/docker-compose.yml
index 3fa2132..05890b6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
       - cache
   cache:
     container_name: kon-redis
-    image: redis/redis-stack-server:7.4.0-rc2
+    image: redis/redis-stack-server:7.4.0-rc2@sha256:18550d52dc39be0bbdcb6a3df57eb34e774ae776b32dfd5f392859d06d470150
     restart: unless-stopped
     ports:
       - 37935:6379/tcp