diff --git a/.drone.yml b/.drone.yml
index 0e04516..980d3a2 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -3,7 +3,7 @@ kind: pipeline
 name: deploy to swarm-test.autonomic.zone
 steps:
   - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest@sha256:fc1fa69bea5528db7ba184297735ac1bbd278720910e4cb1f502de9aee14e228
     settings:
       host: swarm-test.autonomic.zone
       stack: custom_html
@@ -26,7 +26,7 @@ kind: pipeline
 name: generate recipe catalogue
 steps:
   - name: release a new version
-    image: plugins/downstream
+    image: plugins/downstream@sha256:03ff02d8a5637ea5197fa08929a91dfeeb5e30b1da62b82b6c2a895b170338ca
     settings:
       server: https://build.coopcloud.tech
       token:
diff --git a/compose.git-pull.yml b/compose.git-pull.yml
index eeb9371..74341a7 100644
--- a/compose.git-pull.yml
+++ b/compose.git-pull.yml
@@ -3,7 +3,7 @@ services:
   git:
     environment:
       - GIT_REPO_URL
-    image: alpine/git:v2.54.0
+    image: alpine/git:v2.54.0@sha256:0b5f57d22181e8b8fbe8ac5ca8754faa0d577f101b9857418f1acc43955ad464
     entrypoint: /docker-entrypoint.sh
     volumes:
       - content:/git
diff --git a/compose.sftp.yml b/compose.sftp.yml
index 399f305..d16aa3c 100644
--- a/compose.sftp.yml
+++ b/compose.sftp.yml
@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   ssh:
-    image: lscr.io/linuxserver/openssh-server:latest
+    image: lscr.io/linuxserver/openssh-server:latest@sha256:39ba37d50fdd6be1bf70644c871e5dcb9234ee79ac56424ea03ca08cadf1e7b0
     networks:
       - proxy
     environment:
@@ -22,7 +22,7 @@ services:
   # that content can be transferred through the unprivileged sshd process
   # using `scp` etc.
   sshstart:
-    image: lscr.io/linuxserver/openssh-server:latest
+    image: lscr.io/linuxserver/openssh-server:latest@sha256:39ba37d50fdd6be1bf70644c871e5dcb9234ee79ac56424ea03ca08cadf1e7b0
     user: root
     depends_on:
       - ssh
diff --git a/compose.yml b/compose.yml
index 9f7aac2..28b4301 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.31.5
+    image: nginx:1.31.5@sha256:05b8cb60c354a44ab824ea6e7dc69b46d50762cdbe728a347a5b656e6fb3d7c4
     networks:
       - proxy
     deploy: