diff --git a/apps/wasmd/Dockerfile b/apps/wasmd/Dockerfile
index 7c5591a..aac7262 100644
--- a/apps/wasmd/Dockerfile
+++ b/apps/wasmd/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/library/golang:1.23-alpine3.19 AS go-builder
+FROM docker.io/library/golang:1.23-alpine3.19@sha256:b0aab3c1c38ec4b054317b2721c6fff3e55357506dd69942c83ab9447403dec7 AS go-builder
 
 WORKDIR /code
 
@@ -27,7 +27,7 @@ RUN echo "Ensuring binary is statically linked ..." \
   && (file /code/build/wasmd | grep "statically linked")
 
 # --------------------------------------------------------
-FROM docker.io/library/alpine:3.18
+FROM docker.io/library/alpine:3.18@sha256:2995c82e8e723d9a5c8585cb8e901d1c50e3c2759031027d3bff577449435157
 
 # trunk-ignore(hadolint/DL3018)
 RUN apk add --no-cache \