diff --git a/cnpg-pgvector/Dockerfile b/cnpg-pgvector/Dockerfile
index aedeca6de..2db4d52c0 100644
--- a/cnpg-pgvector/Dockerfile
+++ b/cnpg-pgvector/Dockerfile
@@ -1,5 +1,5 @@
 # CNPG operand image with pgvector extension
-ARG PG_MAJOR=15
+ARG PG_MAJOR=15@sha256:7469e92e0e34212970a45a9957ab9017cea74dcdd85eb943a94acb7d5acafc35
 
 FROM ghcr.io/cloudnative-pg/postgresql:$PG_MAJOR as builder
 
diff --git a/datasette/Dockerfile b/datasette/Dockerfile
index 72b95323d..60ca9dd2b 100644
--- a/datasette/Dockerfile
+++ b/datasette/Dockerfile
@@ -1,4 +1,4 @@
-FROM datasetteproject/datasette:0.64
+FROM datasetteproject/datasette:0.64@sha256:4136ff28b289b8c8c384c550cf552d1aca9096e5ae83e8c990090311c158b8b6
 
 RUN adduser script
 
diff --git a/git/Dockerfile b/git/Dockerfile
index 64fee8e3e..60daf697e 100644
--- a/git/Dockerfile
+++ b/git/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine/git:v2.36.3
+FROM alpine/git:v2.36.3@sha256:66b210a97bc07bfd4019826bcd13a488b371a6cbe2630a4b37d23275658bd3f2
 
 RUN adduser -D script
 
diff --git a/wait-for-http/Dockerfile b/wait-for-http/Dockerfile
index f149892fa..32e44d7fc 100644
--- a/wait-for-http/Dockerfile
+++ b/wait-for-http/Dockerfile
@@ -1,4 +1,4 @@
-FROM curlimages/curl:7.86.0
+FROM curlimages/curl:7.86.0@sha256:cfdeba7f88bb85f6c87f2ec9135115b523a1c24943976a61fbf59c4f2eafd78e
 
 COPY ./bin /bin