diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7c907b0..5ba7ce5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -15,9 +15,9 @@ jobs:
     name: Validate templates
     runs-on: ubuntu-latest
     container:
-      image: registry.bobert.me/anthorob/coder-base:terraform
+      image: registry.bobert.me/anthorob/coder-base:terraform@sha256:99688d11f544849944e343fd077ac363d369c09b3bd4ec428b2d6065ac019f9b
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Terraform validate for each template
         run: |
@@ -33,12 +33,12 @@ jobs:
     needs: validate
     runs-on: ubuntu-latest
     container:
-      image: registry.bobert.me/anthorob/coder-base:cli
+      image: registry.bobert.me/anthorob/coder-base:cli@sha256:ff76ef31f7541d3563b5abe76f0753bd775fa654abdc55d0b0a6646c08e503aa
     env:
       COMMIT_SHORT_SHA: ${{ github.sha }}
       REPO: ${{ github.repository }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Deploy each template
         run: |