diff --git a/abra.sh b/abra.sh
index 737eef2..301455d 100644
--- a/abra.sh
+++ b/abra.sh
@@ -4,6 +4,10 @@ export WOPISERVER_CONF_VERSION=v4
 export COLLABORA_ENTRYPOINT_VERSION=v2
 export ONLYOFFICE_ENTRYPOINT_VERSION=v2
 export APP_REGISTRY_VERSION=v2
+# note the leading colon which is required. this allows to also pin to digest (see example below)
+export OCIS_DOCKER_TAG=:2.0.0-beta.8
+# export OCIS_DOCKER_TAG=@sha256:0d7e9949a2bebd9dba5fff49b599051da2aedcf4b7c3cdf866f5d4d11f6e5d98
+
 
 ocis() {
   /usr/bin/ocis "$@"
diff --git a/compose.office.yml b/compose.office.yml
index 8ceed5a..5888ff2 100644
--- a/compose.office.yml
+++ b/compose.office.yml
@@ -9,7 +9,7 @@ services:
         mode: 0666
 
   driver-collabora:
-    image: "owncloud/ocis:2.0.0-beta.8"
+    image: "owncloud/ocis${OCIS_DOCKER_TAG}"
     networks:
       - internal
     command: app-provider server
diff --git a/compose.yml b/compose.yml
index 31131cf..6332a78 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "owncloud/ocis:2.0.0-beta.8"
+    image: "owncloud/ocis${OCIS_DOCKER_TAG}"
     configs:
       - source: app_entrypoint
         target: /docker-entrypoint.sh