diff --git a/03-Kubernetes/cluster-autoscaler/values.yaml b/03-Kubernetes/cluster-autoscaler/values.yaml
index 71d9ae2..b322afa 100644
--- a/03-Kubernetes/cluster-autoscaler/values.yaml
+++ b/03-Kubernetes/cluster-autoscaler/values.yaml
@@ -34,7 +34,7 @@ cluster-autoscaler:
   image:
     repository: k8s.gcr.io/autoscaling/cluster-autoscaler
     pullPolicy: IfNotPresent
-    tag: v1.25.1 # Follows cluster versions schemes: controle plane 1.18 -> tag v1.18.x
+    tag: v1.25.1@sha256:cfdfd46b726a2d5488d4df9c41b636acbab0dff4c01c8c6dbe3d057539f2f2af # Follows cluster versions schemes: controle plane 1.18 -> tag v1.18.x
 
   # Defaults to "ClusterFirst". Valid values are
   # 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'
diff --git a/04-Application/.gitlab-ci.yml b/04-Application/.gitlab-ci.yml
index 9ea790a..b805b15 100644
--- a/04-Application/.gitlab-ci.yml
+++ b/04-Application/.gitlab-ci.yml
@@ -15,7 +15,7 @@ before_script:
 # Permissions are already set to allow Gitlab to access the registry
 build:
   stage: build
-  image: public.ecr.aws/zero-downtime/buildah-awscli:v1.22.0
+  image: public.ecr.aws/zero-downtime/buildah-awscli:v1.22.0@sha256:d79e2ce427fe150871bd8b69defbeb5f2d8f77e8fd4e48d3a1827b4fa3fc5654
   extends:
     - .tags
   variables:
@@ -35,7 +35,7 @@ build:
 
 # This job will deploy our application based on our Kube manifest
 release:
-  image: alpine/helm:latest
+  image: alpine/helm:latest@sha256:9b25e60ae264940b276e32866d37e3088e70c4e2d1784b964dc3f90346281a74
   stage: deploy
   extends:
     - .tags
diff --git a/04-Application/Dockerfile b/04-Application/Dockerfile
index 8a28341..7fa97aa 100644
--- a/04-Application/Dockerfile
+++ b/04-Application/Dockerfile
@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/golang:1.20 AS builder
+FROM public.ecr.aws/docker/library/golang:1.20@sha256:8f9af7094d0cb27cc783c697ac5ba25efdc4da35f8526db21f7aebb0b0b4f18a AS builder
 WORKDIR /app
 
 COPY go.* .