diff --git a/containers/apps/nextcloud-push-notify/Dockerfile b/containers/apps/nextcloud-push-notify/Dockerfile
index 616299254b3..8cce6115847 100644
--- a/containers/apps/nextcloud-push-notify/Dockerfile
+++ b/containers/apps/nextcloud-push-notify/Dockerfile
@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/alpine:3.21.3
+FROM public.ecr.aws/docker/library/alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
 
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 # hadolint ignore=DL3018