diff --git a/.drone.yml b/.drone.yml
index 2519d3d..678891c 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -9,7 +9,7 @@ trigger:
     - main
 steps:
   - name: deploy
-    image: docker
+    image: docker@sha256:9586963dcc07a22641bf03c22f43cd7e45b3107df6bf55c92d8c5098b0ac1750
     volumes:
       - name: docker_sock
         path: /var/run/docker.sock
@@ -36,7 +36,7 @@ trigger:
     - renovate
 steps:
   - name: deploy
-    image: renovate/renovate
+    image: renovate/renovate@sha256:e596cff2b03113f468bd4a671e29c2f26ed5e0695bfc750cb1ce23be3225d443
     commands:
       - renovate
     environment:
diff --git a/compose.yml b/compose.yml
index 45556a8..c0d9a7c 100644
--- a/compose.yml
+++ b/compose.yml
@@ -12,7 +12,7 @@ services:
       - caddy_data:/data
       - caddy_config:/config
   drone:
-    image: drone/drone:2
+    image: drone/drone:2@sha256:cc327f09ea02d676dee02091b88fbcff7e0d24f0b8841b220b3ba6f9df2e66a4
     restart: unless-stopped
     environment:
       DRONE_CRON_INTERVAL: 1m
@@ -27,7 +27,7 @@ services:
       - drone_data_v2:/data
 
   runner:
-    image: drone/drone-runner-docker:1
+    image: drone/drone-runner-docker:1@sha256:9479ddc50e50c205f4508e2062f7dbc757822c7b05ab93de0b8378d97214279b
     restart: unless-stopped
     ports:
       - "127.0.0.1:3000:3000"