diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f1185dc..8452bbf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,7 +18,7 @@ jobs:
         include:
           - name: ubuntu
             image-name: python-base-ubuntu
-            from: ubuntu:22.04
+            from: ubuntu:22.04@sha256:c7eb020043d8fc2ae0793fb35a37bff1cf33f156d4d4b12ccc7f3ef8706c38b1
           - name: ubuntu-cloud-archive
             image-name: python-base-ubuntu-cloud-archive
             from: ghcr.io/vexxhost/ubuntu-cloud-archive:zed@sha256:9177b351fd29b2469e26a0235fb972106fd9409ffdc9527c848123627cd1fd40
@@ -27,13 +27,13 @@ jobs:
             from: ghcr.io/vexxhost/ubuntu-cloud-archive:zed@sha256:9177b351fd29b2469e26a0235fb972106fd9409ffdc9527c848123627cd1fd40
           - name: debian
             image-name: python-base-debian
-            from: debian:bullseye
+            from: debian:bullseye@sha256:8a08b2875ed17adc464ae03cf5f8652a41821fb8d3d2b17923f11e7489b146da
           - name: rockylinux
             image-name: python-base-rockylinux
-            from: rockylinux:9
+            from: rockylinux:9@sha256:d7be1c094cc5845ee815d4632fe377514ee6ebcf8efaed6892889657e5ddaaa6
           - name: almalinux
             image-name: python-base-almalinux
-            from: almalinux:9
+            from: almalinux:9@sha256:27c814f897cf2538496f1653908d653006b5cebd6cebfad26b59ad706243426c
     permissions:
       contents: read
       id-token: write