diff --git a/.github/workflows/build-cluster-api-provider-outscale.yml b/.github/workflows/build-cluster-api-provider-outscale.yml
index 7aefeac..9fc0f9c 100644
--- a/.github/workflows/build-cluster-api-provider-outscale.yml
+++ b/.github/workflows/build-cluster-api-provider-outscale.yml
@@ -29,7 +29,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout outscale/cluster-api-provider-outscale code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           repository: 'outscale/cluster-api-provider-outscale'
@@ -56,7 +56,7 @@ jobs:
           REGISTRY: ${{ env.REGISTRY_BASE_PATH }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/build-k8s-tools.yml b/.github/workflows/build-k8s-tools.yml
index 0cb5223..fa17c1d 100644
--- a/.github/workflows/build-k8s-tools.yml
+++ b/.github/workflows/build-k8s-tools.yml
@@ -26,7 +26,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
 
       - name: Calculate docker image tag
         id: set-tag
@@ -37,7 +37,7 @@ jobs:
           echo "tag=$tag" >> $GITHUB_OUTPUT
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -45,7 +45,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.IMAGE_NAME }}
           tags: |
@@ -53,7 +53,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: k8s-tools
           tags: "${{ env.IMAGE_NAME }}:${{ steps.set-tag.outputs.tag }}, ${{ env.IMAGE_NAME }}:latest"
diff --git a/.github/workflows/build-outscale-cli.yml b/.github/workflows/build-outscale-cli.yml
index 6c54749..93df1a5 100644
--- a/.github/workflows/build-outscale-cli.yml
+++ b/.github/workflows/build-outscale-cli.yml
@@ -26,7 +26,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
 
       - name: Calculate docker image tag
         id: set-tag
@@ -37,7 +37,7 @@ jobs:
           echo "tag=$tag" >> $GITHUB_OUTPUT
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -45,7 +45,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.IMAGE_NAME }}
           tags: |
@@ -53,7 +53,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: outscale-cli
           tags: "${{ env.IMAGE_NAME }}:${{ steps.set-tag.outputs.tag }}, ${{ env.IMAGE_NAME }}:latest"
diff --git a/backup-tools/Dockerfile b/backup-tools/Dockerfile
index f8519b0..7f5f572 100644
--- a/backup-tools/Dockerfile
+++ b/backup-tools/Dockerfile
@@ -1,7 +1,7 @@
 #
 # Base image
 #
-FROM --platform=linux/amd64 debian:12-slim
+FROM --platform=linux/amd64 debian:12-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241
 
 ARG http_proxy=${http_proxy:-}
 ARG https_proxy=${https_proxy:-}
diff --git a/gitlab-runner/Dockerfile b/gitlab-runner/Dockerfile
index 4b13508..ffcf36f 100644
--- a/gitlab-runner/Dockerfile
+++ b/gitlab-runner/Dockerfile
@@ -1,7 +1,7 @@
 #
 # Base image
 #
-FROM --platform=linux/amd64 ubuntu:24.04
+FROM --platform=linux/amd64 ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
 ARG http_proxy=${http_proxy:-}
 ARG https_proxy=${https_proxy:-}
diff --git a/helmfile/Dockerfile b/helmfile/Dockerfile
index ea15eab..0b33f34 100644
--- a/helmfile/Dockerfile
+++ b/helmfile/Dockerfile
@@ -1,4 +1,4 @@
-ARG DOCKER_HELMFILE_VERSION=v1.1.9
+ARG DOCKER_HELMFILE_VERSION=v1.1.9@sha256:08b8aef4e800a3a0ffd6c12246a6a0be8592bf9ec4af92d269d3b0786ada8a6d
 
 FROM --platform=linux/amd64 ghcr.io/helmfile/helmfile-debian-stable-slim:${DOCKER_HELMFILE_VERSION}
 
diff --git a/k8s-tools/Dockerfile b/k8s-tools/Dockerfile
index bd3b4ec..d0424ae 100644
--- a/k8s-tools/Dockerfile
+++ b/k8s-tools/Dockerfile
@@ -1,7 +1,7 @@
 #
 # Base image
 #
-FROM --platform=linux/amd64 debian:bullseye
+FROM --platform=linux/amd64 debian:bullseye@sha256:99cdf7792e25416bd801861ccd8e2fb27fb527b25e8d9a8704ebc3ead2015675
 
 ARG http_proxy=${http_proxy:-}
 ARG https_proxy=${https_proxy:-}
diff --git a/outscale-cli/Dockerfile b/outscale-cli/Dockerfile
index 587587d..8234ed4 100644
--- a/outscale-cli/Dockerfile
+++ b/outscale-cli/Dockerfile
@@ -1,7 +1,7 @@
 #
 # Base image
 #
-FROM --platform=linux/amd64 debian:12-slim
+FROM --platform=linux/amd64 debian:12-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241
 
 ARG http_proxy=${http_proxy:-}
 ARG https_proxy=${https_proxy:-}