diff --git a/Dockerfile b/Dockerfile
index c9a5d26..89f45aa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@ ARG TALHELPER_VERSION=3.0.39
 ARG SOPS_VERSION=3.11.0
 
 # renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-FROM cgr.dev/chainguard/wolfi-base:latest AS downloader
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:c0ead40adeb4b6f55c80c011032a20272e10bde3d745c18bbab7345fccff6791 AS downloader
 
 ARG TALOSCTL_VERSION
 ARG TALHELPER_VERSION
@@ -92,7 +92,7 @@ RUN . /tmp/arches.env; \
 
 
 # renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-FROM cgr.dev/chainguard/wolfi-base:latest
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:c0ead40adeb4b6f55c80c011032a20272e10bde3d745c18bbab7345fccff6791
 
 ARG TALOSCTL_VERSION
 ARG TALHELPER_VERSION
@@ -110,7 +110,7 @@ LABEL org.opencontainers.image.url.talhelper="https://github.com/budimanjojo/tal
 LABEL org.opencontainers.image.url.sops="https://github.com/getsops/sops"
 
 RUN set -eux; \
-    apk add --no-cache ca-certificates-bundle bash git openssh-client curl nodejs npm; \
+    apk add --no-cache ca-certificates-bundle bash git openssh-client curl nodejs npm yq; \
     mkdir -p /usr/local/share/checksums
 
 COPY --from=downloader /tmp/talosctl /usr/local/bin/talosctl