diff --git a/Dockerfile b/Dockerfile
index d4b8b4d545..d5485eb253 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.21 as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.21@sha256:856073656d1a517517792e6cdd2f7a5ef080d3ca2dff33e518c8412f140fdd2d as builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
@@ -28,7 +28,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} GO111MODUL
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static-debian11:nonroot
+FROM --platform=${TARGETPLATFORM:-linux/amd64} gcr.io/distroless/static-debian11:nonroot@sha256:6732c3975d97fac664a5ed15a81a5915e023a7b5a7b58195e733c60b8dc7e684
 WORKDIR /
 COPY --from=builder /workspace/manager .
 ENTRYPOINT ["/manager"]
diff --git a/docs/benchmarks/loadgens/Dockerfile b/docs/benchmarks/loadgens/Dockerfile
index 9a526ca91d..e0446042b7 100644
--- a/docs/benchmarks/loadgens/Dockerfile
+++ b/docs/benchmarks/loadgens/Dockerfile
@@ -15,7 +15,7 @@ WORKDIR /build/sangrenel
 
 RUN go mod download && go build -o /sangrenel
 
-FROM alpine:3.18
+FROM alpine:3.18@sha256:11e21d7b981a59554b3f822c49f6e9f57b6068bb74f49c4cd5cc4c663c7e5160
 
 RUN apk add --update --no-cache ca-certificates tzdata curl bash
 
diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
index 447b42a1a8..0d932d0ae4 100644
--- a/hack/kafka-test-pod/Dockerfile
+++ b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.21 as builder
+FROM golang:1.21@sha256:856073656d1a517517792e6cdd2f7a5ef080d3ca2dff33e518c8412f140fdd2d as builder
 
 WORKDIR /workspace