diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4597e90..a7251a2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,7 +18,7 @@ jobs:
         include:
           - name: ubuntu
             image-name: python-base-ubuntu
-            from: ubuntu:24.04
+            from: ubuntu:24.04@sha256:cd1dba651b3080c3686ecf4e3c4220f026b521fb76978881737d24f200828b2b
           - name: ubuntu-cloud-archive
             image-name: python-base-ubuntu-cloud-archive
             from: ghcr.io/vexxhost/ubuntu-cloud-archive:2025.2@sha256:ac32af5dba570900ca94e6fde00007a496a801334bb2a0f2663d886910bc62a9
@@ -27,13 +27,13 @@ jobs:
             from: ghcr.io/vexxhost/ubuntu-cloud-archive:2025.2@sha256:ac32af5dba570900ca94e6fde00007a496a801334bb2a0f2663d886910bc62a9
           - name: debian
             image-name: python-base-debian
-            from: debian:trixie
+            from: debian:trixie@sha256:5cf544fad978371b3df255b61e209b373583cb88b733475c86e49faa15ac2104
           - name: rockylinux
             image-name: python-base-rockylinux
-            from: rockylinux:9
+            from: rockylinux:9@sha256:d7be1c094cc5845ee815d4632fe377514ee6ebcf8efaed6892889657e5ddaaa6
           - name: almalinux
             image-name: python-base-almalinux
-            from: almalinux:9
+            from: almalinux:9@sha256:27c814f897cf2538496f1653908d653006b5cebd6cebfad26b59ad706243426c
     permissions:
       contents: read
       id-token: write