diff --git a/Containerfile b/Containerfile
index 36c9f5c..15a4736 100644
--- a/Containerfile
+++ b/Containerfile
@@ -8,7 +8,7 @@ FROM scratch AS ctx
 COPY ./scripts /scripts
 COPY ./files /files
 
-FROM quay.io/fedora/fedora-bootc:latest AS build
+FROM quay.io/fedora/fedora-bootc:latest@sha256:6a5d572ec60a704ea10fd3c6deb3b1d557bb1fb04a2f7a8076607ebcdc42ad02 AS build
 
 COPY --from=ctx files/ /
 
@@ -27,7 +27,7 @@ RUN --network=none \
 # Rechunk the image into component-aligned OCI layers via chunkah.
 # Build must use --skip-unused-stages=false for the oci-archive stage to work.
 # See https://github.com/coreos/chunkah#splitting-an-image-at-build-time-buildahpodman-only
-FROM quay.io/coreos/chunkah:dev AS chunkah
+FROM quay.io/coreos/chunkah:dev@sha256:51cd01ce6f04f129b7049262905551fbeb8d0277228b3520bb90a239021157b4 AS chunkah
 RUN --mount=from=build,src=/,target=/chunkah,ro \
   chunkah build \
   --prune /sysroot/ \
diff --git a/Containerfile.installer b/Containerfile.installer
index 3837c5b..54024ed 100644
--- a/Containerfile.installer
+++ b/Containerfile.installer
@@ -1,6 +1,6 @@
 # Installer container for building bootc-installer ISOs
 # This container includes Anaconda and required tools for ISO creation
-FROM quay.io/fedora/fedora-bootc:latest
+FROM quay.io/fedora/fedora-bootc:latest@sha256:6a5d572ec60a704ea10fd3c6deb3b1d557bb1fb04a2f7a8076607ebcdc42ad02
 
 RUN --mount=type=cache,target=/var/cache \
     --mount=type=cache,target=/var/lib \