diff --git a/Dockerfile b/Dockerfile
index 855da3a..c76b032 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
 # Trivy is a single static binary, so it can be copied into a slim base image.
-ARG TRIVY_IMAGE=aquasec/trivy:latest
+ARG TRIVY_IMAGE=aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
 FROM ${TRIVY_IMAGE} AS trivy
 
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704
 
 LABEL org.opencontainers.image.title="docker-vuln-scan" \
       org.opencontainers.image.description="Trivy image vulnerability scanner with Apprise alerts" \