diff --git a/docker/Dockerfile.agent.alpine.multiarch b/docker/Dockerfile.agent.alpine.multiarch
index b294377e8a..c0296453a3 100644
--- a/docker/Dockerfile.agent.alpine.multiarch
+++ b/docker/Dockerfile.agent.alpine.multiarch
@@ -8,7 +8,9 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     make build-agent
 
 FROM docker.io/alpine:3.18
-RUN apk add -U --no-cache ca-certificates
+# renovate: datasource=repology depName=alpine_3_18/ca-certificates versioning=loose
+ENV CA_CERTIFICATES_VERSION="20230506-r0"
+RUN apk add -U --no-cache ca-certificates=${CA_CERTIFICATES_VERSION}
 ENV GODEBUG=netdns=go
 EXPOSE 3000
 
diff --git a/docker/Dockerfile.cli.alpine.multiarch b/docker/Dockerfile.cli.alpine.multiarch
index 0e647eb7bb..4055474e59 100644
--- a/docker/Dockerfile.cli.alpine.multiarch
+++ b/docker/Dockerfile.cli.alpine.multiarch
@@ -8,7 +8,9 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     make build-cli
 
 FROM docker.io/alpine:3.18
-RUN apk add -U --no-cache ca-certificates
+# renovate: datasource=repology depName=alpine_3_18/ca-certificates versioning=loose
+ENV CA_CERTIFICATES_VERSION="20230506-r0"
+RUN apk add -U --no-cache ca-certificates=${CA_CERTIFICATES_VERSION}
 ENV GODEBUG=netdns=go
 
 COPY --from=build /src/dist/woodpecker-cli /bin/
diff --git a/docker/Dockerfile.make b/docker/Dockerfile.make
index 05918fa681..e2c872ff0e 100644
--- a/docker/Dockerfile.make
+++ b/docker/Dockerfile.make
@@ -1,8 +1,17 @@
 # docker build --rm  -f docker/Dockerfile.make -t woodpecker/make:local .
-FROM docker.io/golang:1.21-alpine as golang_image
-FROM docker.io/node:21-alpine
+FROM docker.io/golang:1.21-alpine3.18 as golang_image
+FROM docker.io/node:21-alpine3.18
 
-RUN apk add --no-cache --update make gcc binutils-gold musl-dev && \
+# renovate: datasource=repology depName=alpine_3_18/make versioning=loose
+ENV MAKE_VERSION="4.4.1-r1"
+# renovate: datasource=repology depName=alpine_3_18/gcc versioning=loose
+ENV GCC_VERSION="12.2.1_git20220924-r108"
+# renovate: datasource=repology depName=alpine_3_18/binutils-gold versioning=loose
+ENV BINUTILS_GOLD_VERSION="2.40-r7"
+# renovate: datasource=repology depName=alpine_3_18/musl-dev versioning=loose
+ENV MUSL_DEV_VERSION="1.2.4-r2"
+
+RUN apk add --no-cache --update make=${MAKE_VERSION} gcc=${GCC_VERSION} binutils-gold=2.40-r7 musl-dev=${MUSL_DEV_VERSION} && \
   corepack enable
 
 # Build packages.
diff --git a/docker/Dockerfile.server.alpine.multiarch b/docker/Dockerfile.server.alpine.multiarch
index 20fcaf4157..b518ce68ac 100644
--- a/docker/Dockerfile.server.alpine.multiarch
+++ b/docker/Dockerfile.server.alpine.multiarch
@@ -1,7 +1,10 @@
 FROM docker.io/alpine:3.18
 
+# renovate: datasource=repology depName=alpine_3_18/ca-certificates versioning=loose
+ENV CA_CERTIFICATES_VERSION="20230506-r0"
+
 ARG TARGETOS TARGETARCH
-RUN apk add -U --no-cache ca-certificates
+RUN apk add -U --no-cache ca-certificates=${CA_CERTIFICATES_VERSION}
 ENV GODEBUG=netdns=go
 ENV WOODPECKER_DATABASE_DATASOURCE=/var/lib/woodpecker/woodpecker.sqlite
 ENV WOODPECKER_DATABASE_DRIVER=sqlite3