diff --git a/containers/apps/db-wait-redis/Dockerfile b/containers/apps/db-wait-redis/Dockerfile
index afc1f3902d6..862f9d17f97 100644
--- a/containers/apps/db-wait-redis/Dockerfile
+++ b/containers/apps/db-wait-redis/Dockerfile
@@ -1,5 +1,5 @@
 # hadolint ignore=DL3007
-FROM tccr.io/tccr/alpine:latest
+FROM tccr.io/tccr/alpine:latest@sha256:8ae22cc7c6f2dbc803e2d7e8aff41496d72a3ec4c2527501baac5f94360ed20a
 
 ARG TARGETPLATFORM
 ARG VERSION
diff --git a/containers/apps/traefik/Dockerfile b/containers/apps/traefik/Dockerfile
index b2cb05e72db..0cdb981e1dd 100644
--- a/containers/apps/traefik/Dockerfile
+++ b/containers/apps/traefik/Dockerfile
@@ -1,7 +1,7 @@
 FROM public.ecr.aws/docker/library/traefik:v3.4.0@sha256:4cf907247939b5d20bf4eff73abd21cb413c339600dde76dbc94a874b2578a27
 # Above line used by CI to find tags etc
 
-FROM public.ecr.aws/docker/library/alpine:3.21.3 as plugins
+FROM public.ecr.aws/docker/library/alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c as plugins
 
 # FIXME: Find a way to keep versions up to date
 # -- Use the following prefixes to specify plugins to clone