diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 78979cf..70d91bf 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -8,7 +8,7 @@ on:
 jobs:
   shared-operator-workflow:
     name: shared-operator-workflow
-    uses: redhat-cop/github-workflows-operators/.github/workflows/pr-operator.yml@v1.0.4
+    uses: redhat-cop/github-workflows-operators/.github/workflows/pr-operator.yml@db94696b37f75c4d3d2e571de44612bf24a26d68 # v1.0.4
     with: 
       RUN_UNIT_TESTS: true
       RUN_INTEGRATION_TESTS: false
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 45658cb..a92e984 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -10,7 +10,7 @@ on:
 jobs:
   shared-operator-workflow:
     name: shared-operator-workflow
-    uses: redhat-cop/github-workflows-operators/.github/workflows/release-operator.yml@v1.0.4
+    uses: redhat-cop/github-workflows-operators/.github/workflows/release-operator.yml@db94696b37f75c4d3d2e571de44612bf24a26d68 # v1.0.4
     secrets:
       COMMUNITY_OPERATOR_PAT: ${{ secrets.COMMUNITY_OPERATOR_PAT }}
       REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
diff --git a/Dockerfile b/Dockerfile
index bb63d0f..8a7bfcf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.18 as builder
+FROM golang:1.18@sha256:50c889275d26f816b5314fc99f55425fa76b18fcaf16af255f5d57f09e1f48da as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -19,7 +19,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -o manager main.go
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:6732c3975d97fac664a5ed15a81a5915e023a7b5a7b58195e733c60b8dc7e684
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532
diff --git a/ci.Dockerfile b/ci.Dockerfile
index 1c17792..bd39075 100644
--- a/ci.Dockerfile
+++ b/ci.Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal
+FROM registry.access.redhat.com/ubi8/ubi-minimal@sha256:8bedbe742f140108897fb3532068e8316900d9814f399d676ac78b46e740e34e
 WORKDIR /
 COPY bin/manager .
 USER 65532:65532
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
index 79f0167..99f6c46 100644
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -13,4 +13,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: quay.io/raffaelespazzoli/patch-operator
-  newTag: latest
+  newTag: latest@sha256:47bf8e40af3def8af55b96ea5b85adfd4ada33d93f8d661cad233f4948c8b58f