diff --git a/.drone.yml b/.drone.yml
index ed15a96..3fc90ea 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -3,7 +3,7 @@ kind: pipeline
 name: deploy to swarm-test.autonomic.zone
 steps:
   - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest@sha256:fc1fa69bea5528db7ba184297735ac1bbd278720910e4cb1f502de9aee14e228
     settings:
       host: swarm-test.autonomic.zone
       stack: grist
@@ -25,7 +25,7 @@ kind: pipeline
 name: generate recipe catalogue
 steps:
   - name: release a new version
-    image: plugins/downstream
+    image: plugins/downstream@sha256:03ff02d8a5637ea5197fa08929a91dfeeb5e30b1da62b82b6c2a895b170338ca
     settings:
       server: https://build.coopcloud.tech
       token:
diff --git a/compose.yml b/compose.yml
index 8262730..1489372 100644
--- a/compose.yml
+++ b/compose.yml
@@ -1,6 +1,6 @@
 services:
   app:
-    image: gristlabs/grist-oss:1.7.19
+    image: gristlabs/grist-oss:1.7.19@sha256:3e43d3afc9ca86a9df0d65c247e51556ce5463dde91b278bcf98ae3edc1e1701
     networks:
       - proxy
       - internal
@@ -58,7 +58,7 @@ services:
         - "backupbot.backup.path=/persist"
 
   redis:
-    image: redis:8.10-alpine
+    image: redis:8.10-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
     networks:
       - internal
     volumes: