diff --git a/deploy/charts/burrito/values.yaml b/deploy/charts/burrito/values.yaml
index 680eb3b8..045c4025 100644
--- a/deploy/charts/burrito/values.yaml
+++ b/deploy/charts/burrito/values.yaml
@@ -158,7 +158,7 @@ hermitcrab:
     image:
       pullPolicy: Always
       repository: sealio/hermitcrab
-      tag: main
+      tag: main@sha256:ca8eb5846c8d1c2f77c9f4d42ad4713ea07403ecb1f5b7b127ca3e2e177c3496
     # -- Hermitcrab environment variables
     env:
       - name: SERVER_TLS_CERT_FILE
diff --git a/manifests/base/kustomization.yaml b/manifests/base/kustomization.yaml
index 45cf73e4..b9ac6a99 100644
--- a/manifests/base/kustomization.yaml
+++ b/manifests/base/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 images:
   - name: ghcr.io/padok-team/burrito
     newName: ghcr.io/padok-team/burrito
-    newTag: main
+    newTag: main@sha256:3304eb932c5469cf3ad91aa746f58c7e43ae5a6fa736b62def56048a0cba3ba6
 
 resources:
   - ./controllers
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 5941363c..53226d54 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20 AS build
+FROM node:20@sha256:a5e0ed56f2c20b9689e0f7dd498cac7e08d2a3a283e92d9304e7b9b83e3c6ff3 AS build
 WORKDIR /app
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile
@@ -7,7 +7,7 @@ ARG API_BASE_URL
 ENV VITE_API_BASE_URL=$API_BASE_URL
 RUN yarn build
 
-FROM nginx:stable-alpine
+FROM nginx:stable-alpine@sha256:5b44a5ab8ab467854f2bf7b835a32f850f32eb414b749fbf7ed506b139cd8d6b
 WORKDIR /usr/share/nginx/html
 COPY default.conf /etc/nginx/conf.d/default.conf
 RUN rm -rf ./*