diff --git a/config/docker-compose-common-services.yaml b/config/docker-compose-common-services.yaml
index c39cb92..8d058d9 100644
--- a/config/docker-compose-common-services.yaml
+++ b/config/docker-compose-common-services.yaml
@@ -4,7 +4,7 @@ services:
 
   cloud-agent:
     container_name: cloud-agent
-    image: index.docker.io/sourcegraph/src-tunnel-agent:2024-02-15-04-02-110c2ea9
+    image: index.docker.io/sourcegraph/src-tunnel-agent:2024-02-15-04-02-110c2ea9@sha256:54f3590b4cfd0ad24b0506d44e2dea1df0d777d66792668d4ba88e348cf731f9
     volumes:
       - ../config/cloud-agent-service-account-key.json:/sourcegraph/cloud-agent-service-account-key.json:ro
       - ../config/cloud-agent-config.yaml:/sourcegraph/cloud-agent-config.yaml:ro
@@ -16,7 +16,7 @@ services:
   src-serve-git:
     # Uses a valid hostname as container_name, to trick the cloud agent and code host config into finding this container on the Docker network
     container_name: src-serve-git-ubuntu.local
-    image:  index.docker.io/sourcegraph/src-cli:latest
+    image:  index.docker.io/sourcegraph/src-cli:latest@sha256:ee341c77f7be35d7059279f48bcb6b8b089889089f86029647a832710d8674fd
     volumes:
       - ../src-serve-root/:/sourcegraph/src-serve-root:ro
     command: "serve-git -addr :443 /sourcegraph/src-serve-root"
diff --git a/repo-converter/build/Dockerfile b/repo-converter/build/Dockerfile
index cf156c6..fe7eb96 100644
--- a/repo-converter/build/Dockerfile
+++ b/repo-converter/build/Dockerfile
@@ -1,7 +1,7 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1@sha256:ac85f380a63b13dfcefa89046420e1781752bab202122f8f50032edf31be0021
 
 # Using Ubuntu LTS
-FROM ubuntu:22.04 as base
+FROM ubuntu:22.04@sha256:77906da86b60585ce12215807090eb327e7386c8fafb5402369e421f44eff17e as base
 
 # Avoid stuck build due to user prompt
 ARG DEBIAN_FRONTEND=noninteractive
diff --git a/repo-converter/docker-compose.yaml b/repo-converter/docker-compose.yaml
index b347883..c30e7ca 100644
--- a/repo-converter/docker-compose.yaml
+++ b/repo-converter/docker-compose.yaml
@@ -9,7 +9,7 @@ services:
 
   repo-converter:
     container_name: repo-converter
-    image: ghcr.io/sourcegraph/implementation-bridge-repo-converter:main
+    image: ghcr.io/sourcegraph/implementation-bridge-repo-converter:main@sha256:8852331849c79a2fe4ae6c4d2f036e08c7b654df69b64cb0616619e2011e7634
     volumes:
       - ../config/repos-to-convert.yaml:/sourcegraph/repos-to-convert.yaml:ro
       - ../config/toprc:/root/.config/procps/toprc