diff --git a/Dockerfile b/Dockerfile
index 6733297..7c7f0c2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
 
 # Build an OCI image that provides:
 #  - talosctl
@@ -17,7 +17,7 @@ ARG TALHELPER_VERSION=3.0.39
 ARG SOPS_VERSION=3.11.0
 
 # renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-FROM cgr.dev/chainguard/wolfi-base:latest AS downloader
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:c0ead40adeb4b6f55c80c011032a20272e10bde3d745c18bbab7345fccff6791 AS downloader
 
 ARG TALOSCTL_VERSION
 ARG TALHELPER_VERSION
@@ -92,7 +92,7 @@ RUN . /tmp/arches.env; \
 
 
 # renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-FROM cgr.dev/chainguard/wolfi-base:latest
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:c0ead40adeb4b6f55c80c011032a20272e10bde3d745c18bbab7345fccff6791
 
 ARG TALOSCTL_VERSION
 ARG TALHELPER_VERSION