From e6ebee7bef74f6730279b7f319204115d02af7d4 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 2 Dec 2023 17:00:14 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/build-docker-generic-pr.yaml            | 4 ++--
 .github/workflows/build-s2i-executable-pr.yaml            | 4 ++--
 .github/workflows/build-s2i-gows-pr.yaml                  | 4 ++--
 .github/workflows/build-s2i-jekyll-pr.yaml                | 4 ++--
 .github/workflows/build-s2i-liberty-pr.yaml               | 4 ++--
 .github/workflows/build-s2i-python-kopf-pr.yaml           | 6 +++---
 .github/workflows/build-s2i-python-kopf-publish.yaml      | 8 ++++----
 .github/workflows/conftest.yaml                           | 2 +-
 .github/workflows/github-runner-ubi8-pr.yaml              | 4 ++--
 .github/workflows/github-runner-ubi8-publish.yaml         | 8 ++++----
 .github/workflows/hoverfly-pr.yaml                        | 4 ++--
 .github/workflows/hygieia-pr.yaml                         | 4 ++--
 .github/workflows/jenkins-agent-ansible-pr.yaml           | 4 ++--
 .github/workflows/jenkins-agent-arachni-pr.yaml           | 4 ++--
 .github/workflows/jenkins-agent-argocd-pr.yaml            | 4 ++--
 .github/workflows/jenkins-agent-ci-pr.yaml                | 4 ++--
 .github/workflows/jenkins-agent-conftest-pr.yaml          | 4 ++--
 .github/workflows/jenkins-agent-cosign-pr.yaml            | 4 ++--
 .github/workflows/jenkins-agent-erlang-pr.yaml            | 4 ++--
 .github/workflows/jenkins-agent-golang-pr.yaml            | 4 ++--
 .github/workflows/jenkins-agent-graalvm-pr.yaml           | 4 ++--
 .github/workflows/jenkins-agent-gradle-pr.yaml            | 4 ++--
 .github/workflows/jenkins-agent-helm-pr.yaml              | 4 ++--
 .github/workflows/jenkins-agent-hugo-pr.yaml              | 4 ++--
 .github/workflows/jenkins-agent-image-mgmt-pr.yaml        | 4 ++--
 .github/workflows/jenkins-agent-image-mgmt-publish.yaml   | 8 ++++----
 .github/workflows/jenkins-agent-mongodb-pr.yaml           | 4 ++--
 .github/workflows/jenkins-agent-mvn-pr.yaml               | 4 ++--
 .github/workflows/jenkins-agent-npm-pr.yaml               | 4 ++--
 .github/workflows/jenkins-agent-python-pr.yaml            | 4 ++--
 .github/workflows/jenkins-agent-python-publish.yaml       | 8 ++++----
 .github/workflows/jenkins-agent-ruby-pr.yaml              | 4 ++--
 .github/workflows/jenkins-agent-rust-pr.yaml              | 4 ++--
 .github/workflows/jenkins-agent-zap-pr.yaml               | 4 ++--
 .github/workflows/rabbitmq-pr.yaml                        | 4 ++--
 .github/workflows/rabbitmq-publish.yaml                   | 8 ++++----
 .github/workflows/s2i-mvn-gradle-pr.yaml                  | 4 ++--
 .github/workflows/sonarqube-pr.yaml                       | 4 ++--
 .github/workflows/tekton-task-images-conftest-pr.yaml     | 4 ++--
 .../workflows/tekton-task-images-conftest-publish.yaml    | 8 ++++----
 .github/workflows/tekton-task-images-helm-pr.yaml         | 4 ++--
 .github/workflows/tekton-task-images-helm-publish.yaml    | 8 ++++----
 .github/workflows/tookbox-pr.yaml                         | 4 ++--
 .github/workflows/ubi7-gitlab-runner-pr.yaml              | 4 ++--
 .github/workflows/ubi7-gitlab-runner-publish.yaml         | 8 ++++----
 .github/workflows/ubi8-asciidoctor-pr.yaml                | 4 ++--
 .github/workflows/ubi8-asciidoctor-publish.yaml           | 8 ++++----
 .github/workflows/ubi8-bats-pr.yaml                       | 4 ++--
 .github/workflows/ubi8-bats-publish.yaml                  | 8 ++++----
 .github/workflows/ubi8-git-pr.yaml                        | 4 ++--
 .github/workflows/ubi8-git-publish.yaml                   | 8 ++++----
 .github/workflows/ubi8-google-api-python-client-pr.yaml   | 4 ++--
 .../workflows/ubi8-google-api-python-client-publish.yaml  | 8 ++++----
 build-docker-generic/Dockerfile                           | 2 +-
 build-s2i-gows/Dockerfile                                 | 2 +-
 build-s2i-jekyll/Dockerfile                               | 2 +-
 build-s2i-liberty/Dockerfile                              | 2 +-
 build-s2i-python-kopf/Dockerfile                          | 2 +-
 github-runner-ubi8/Dockerfile                             | 2 +-
 hoverfly/Dockerfile                                       | 2 +-
 jenkins-agents/jenkins-agent-ansible/Dockerfile           | 2 +-
 jenkins-agents/jenkins-agent-arachni/Dockerfile           | 2 +-
 jenkins-agents/jenkins-agent-argocd/Dockerfile            | 2 +-
 jenkins-agents/jenkins-agent-conftest/Dockerfile          | 2 +-
 jenkins-agents/jenkins-agent-cosign/Dockerfile            | 2 +-
 jenkins-agents/jenkins-agent-erlang/Dockerfile            | 2 +-
 jenkins-agents/jenkins-agent-golang/Dockerfile            | 2 +-
 jenkins-agents/jenkins-agent-graalvm/Dockerfile           | 2 +-
 jenkins-agents/jenkins-agent-gradle/Dockerfile            | 2 +-
 jenkins-agents/jenkins-agent-helm/Dockerfile              | 2 +-
 jenkins-agents/jenkins-agent-hugo/Dockerfile              | 2 +-
 jenkins-agents/jenkins-agent-image-mgmt/Dockerfile        | 4 ++--
 jenkins-agents/jenkins-agent-mongodb/Dockerfile           | 2 +-
 jenkins-agents/jenkins-agent-mvn/Dockerfile               | 2 +-
 jenkins-agents/jenkins-agent-npm/Dockerfile               | 2 +-
 jenkins-agents/jenkins-agent-python/Dockerfile            | 2 +-
 jenkins-agents/jenkins-agent-ruby/Dockerfile              | 2 +-
 jenkins-agents/jenkins-agent-rust/Dockerfile              | 2 +-
 jenkins-agents/jenkins-agent-zap/Dockerfile               | 2 +-
 s2i-mvn-gradle/Dockerfile                                 | 2 +-
 sonarqube/Dockerfile                                      | 2 +-
 tool-box/Dockerfile                                       | 2 +-
 ubi7-gitlab-runner/Dockerfile                             | 2 +-
 utilities/ubi8-asciidoctor/Dockerfile                     | 2 +-
 utilities/ubi8-bats/Dockerfile                            | 2 +-
 utilities/ubi8-git/Dockerfile                             | 2 +-
 utilities/ubi8-google-api-python-client/Dockerfile        | 2 +-
 87 files changed, 165 insertions(+), 165 deletions(-)

diff --git a/.github/workflows/build-docker-generic-pr.yaml b/.github/workflows/build-docker-generic-pr.yaml
index bfe201e36..213df75ec 100644
--- a/.github/workflows/build-docker-generic-pr.yaml
+++ b/.github/workflows/build-docker-generic-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: build-docker-generic
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-executable-pr.yaml b/.github/workflows/build-s2i-executable-pr.yaml
index 37f96ee70..a85576818 100644
--- a/.github/workflows/build-s2i-executable-pr.yaml
+++ b/.github/workflows/build-s2i-executable-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: build-s2i-executable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-gows-pr.yaml b/.github/workflows/build-s2i-gows-pr.yaml
index 1269a3f44..0150d4d79 100644
--- a/.github/workflows/build-s2i-gows-pr.yaml
+++ b/.github/workflows/build-s2i-gows-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: build-s2i-gows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-jekyll-pr.yaml b/.github/workflows/build-s2i-jekyll-pr.yaml
index 5e0114a81..ad9bd2385 100644
--- a/.github/workflows/build-s2i-jekyll-pr.yaml
+++ b/.github/workflows/build-s2i-jekyll-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: build-s2i-jekyll
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-liberty-pr.yaml b/.github/workflows/build-s2i-liberty-pr.yaml
index 112165777..2a46ffaf8 100644
--- a/.github/workflows/build-s2i-liberty-pr.yaml
+++ b/.github/workflows/build-s2i-liberty-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: build-s2i-liberty
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-python-kopf-pr.yaml b/.github/workflows/build-s2i-python-kopf-pr.yaml
index d722b95c9..7d229fed5 100644
--- a/.github/workflows/build-s2i-python-kopf-pr.yaml
+++ b/.github/workflows/build-s2i-python-kopf-pr.yaml
@@ -12,7 +12,7 @@ jobs:
       IMAGE_NAME: python-kopf-s2i
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -25,7 +25,7 @@ jobs:
           sed -i -e "s/^FROM .*/FROM ${IMAGE_NAME}:${{ steps.check_version.outputs.VERSION }}/" ${CONTEXT_DIR}/examples/kopf-simple/Dockerfile
 
       - name: Build s2i image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}
           dockerfiles: |
@@ -35,7 +35,7 @@ jobs:
           tags: ${{ steps.check_version.outputs.VERSION }}
 
       - name: Build kopf-simple example from s2i image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}/examples/kopf-simple
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-python-kopf-publish.yaml b/.github/workflows/build-s2i-python-kopf-publish.yaml
index 007d55819..bb81eaec4 100644
--- a/.github/workflows/build-s2i-python-kopf-publish.yaml
+++ b/.github/workflows/build-s2i-python-kopf-publish.yaml
@@ -13,7 +13,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -23,7 +23,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}
           dockerfiles: |
@@ -32,7 +32,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -43,7 +43,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/conftest.yaml b/.github/workflows/conftest.yaml
index 0986d4b3d..606aba985 100644
--- a/.github/workflows/conftest.yaml
+++ b/.github/workflows/conftest.yaml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Conftest
         uses: redhat-cop/github-actions/confbatstest@master
diff --git a/.github/workflows/github-runner-ubi8-pr.yaml b/.github/workflows/github-runner-ubi8-pr.yaml
index 596a692af..fa896f23c 100644
--- a/.github/workflows/github-runner-ubi8-pr.yaml
+++ b/.github/workflows/github-runner-ubi8-pr.yaml
@@ -12,7 +12,7 @@ jobs:
       IMAGE_NAME: github-runner-ubi8
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}
           dockerfiles: |
diff --git a/.github/workflows/github-runner-ubi8-publish.yaml b/.github/workflows/github-runner-ubi8-publish.yaml
index 1a1aeb5e4..d4934ddc4 100644
--- a/.github/workflows/github-runner-ubi8-publish.yaml
+++ b/.github/workflows/github-runner-ubi8-publish.yaml
@@ -13,7 +13,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -23,7 +23,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}
           dockerfiles: |
@@ -33,7 +33,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -43,7 +43,7 @@ jobs:
 
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/hoverfly-pr.yaml b/.github/workflows/hoverfly-pr.yaml
index 2aae2170d..06208a575 100644
--- a/.github/workflows/hoverfly-pr.yaml
+++ b/.github/workflows/hoverfly-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: hoverfly
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/hygieia-pr.yaml b/.github/workflows/hygieia-pr.yaml
index 417b96071..8d805692b 100644
--- a/.github/workflows/hygieia-pr.yaml
+++ b/.github/workflows/hygieia-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: hygieia
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-ansible-pr.yaml b/.github/workflows/jenkins-agent-ansible-pr.yaml
index 5005312be..08afc72ab 100644
--- a/.github/workflows/jenkins-agent-ansible-pr.yaml
+++ b/.github/workflows/jenkins-agent-ansible-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-ansible
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-arachni-pr.yaml b/.github/workflows/jenkins-agent-arachni-pr.yaml
index b2216053e..f308f1f51 100644
--- a/.github/workflows/jenkins-agent-arachni-pr.yaml
+++ b/.github/workflows/jenkins-agent-arachni-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-arachni
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-argocd-pr.yaml b/.github/workflows/jenkins-agent-argocd-pr.yaml
index c841ad58d..7dcc7b2ff 100644
--- a/.github/workflows/jenkins-agent-argocd-pr.yaml
+++ b/.github/workflows/jenkins-agent-argocd-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-argocd
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-ci-pr.yaml b/.github/workflows/jenkins-agent-ci-pr.yaml
index fd19fff15..451aaec99 100644
--- a/.github/workflows/jenkins-agent-ci-pr.yaml
+++ b/.github/workflows/jenkins-agent-ci-pr.yaml
@@ -13,10 +13,10 @@ jobs:
       image_name: jenkins-agent-ansible
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-conftest-pr.yaml b/.github/workflows/jenkins-agent-conftest-pr.yaml
index 83e1c98f6..acaf46dde 100644
--- a/.github/workflows/jenkins-agent-conftest-pr.yaml
+++ b/.github/workflows/jenkins-agent-conftest-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-conftest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-cosign-pr.yaml b/.github/workflows/jenkins-agent-cosign-pr.yaml
index 974c7939b..a8fc2086e 100644
--- a/.github/workflows/jenkins-agent-cosign-pr.yaml
+++ b/.github/workflows/jenkins-agent-cosign-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-cosign
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-erlang-pr.yaml b/.github/workflows/jenkins-agent-erlang-pr.yaml
index 528ad0ee6..5f945d6c5 100644
--- a/.github/workflows/jenkins-agent-erlang-pr.yaml
+++ b/.github/workflows/jenkins-agent-erlang-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-erlang
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-golang-pr.yaml b/.github/workflows/jenkins-agent-golang-pr.yaml
index aa35c0587..63b50ced0 100644
--- a/.github/workflows/jenkins-agent-golang-pr.yaml
+++ b/.github/workflows/jenkins-agent-golang-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-golang
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-graalvm-pr.yaml b/.github/workflows/jenkins-agent-graalvm-pr.yaml
index f471091de..4bdb21492 100644
--- a/.github/workflows/jenkins-agent-graalvm-pr.yaml
+++ b/.github/workflows/jenkins-agent-graalvm-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-graalvm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-gradle-pr.yaml b/.github/workflows/jenkins-agent-gradle-pr.yaml
index 7a7274941..5b93086bb 100644
--- a/.github/workflows/jenkins-agent-gradle-pr.yaml
+++ b/.github/workflows/jenkins-agent-gradle-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-gradle
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-helm-pr.yaml b/.github/workflows/jenkins-agent-helm-pr.yaml
index 650eb6c30..a571c85dc 100644
--- a/.github/workflows/jenkins-agent-helm-pr.yaml
+++ b/.github/workflows/jenkins-agent-helm-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-helm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-hugo-pr.yaml b/.github/workflows/jenkins-agent-hugo-pr.yaml
index 4928f5d32..b019af9c8 100644
--- a/.github/workflows/jenkins-agent-hugo-pr.yaml
+++ b/.github/workflows/jenkins-agent-hugo-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-hugo
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-image-mgmt-pr.yaml b/.github/workflows/jenkins-agent-image-mgmt-pr.yaml
index c429de0b1..206dfdbfa 100644
--- a/.github/workflows/jenkins-agent-image-mgmt-pr.yaml
+++ b/.github/workflows/jenkins-agent-image-mgmt-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: jenkins-agent-image-mgmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-image-mgmt-publish.yaml b/.github/workflows/jenkins-agent-image-mgmt-publish.yaml
index 58db3eaaf..cb479f5b1 100644
--- a/.github/workflows/jenkins-agent-image-mgmt-publish.yaml
+++ b/.github/workflows/jenkins-agent-image-mgmt-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/jenkins-agent-mongodb-pr.yaml b/.github/workflows/jenkins-agent-mongodb-pr.yaml
index 85c2e0c5d..13abc4094 100644
--- a/.github/workflows/jenkins-agent-mongodb-pr.yaml
+++ b/.github/workflows/jenkins-agent-mongodb-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-mongodb
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-mvn-pr.yaml b/.github/workflows/jenkins-agent-mvn-pr.yaml
index 9e165868c..b6a13a2b2 100644
--- a/.github/workflows/jenkins-agent-mvn-pr.yaml
+++ b/.github/workflows/jenkins-agent-mvn-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-mvn
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-npm-pr.yaml b/.github/workflows/jenkins-agent-npm-pr.yaml
index 42d6aa721..69e24ee7d 100644
--- a/.github/workflows/jenkins-agent-npm-pr.yaml
+++ b/.github/workflows/jenkins-agent-npm-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-npm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-python-pr.yaml b/.github/workflows/jenkins-agent-python-pr.yaml
index 05ba400ac..c9f03915a 100644
--- a/.github/workflows/jenkins-agent-python-pr.yaml
+++ b/.github/workflows/jenkins-agent-python-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: jenkins-agent-python
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-python-publish.yaml b/.github/workflows/jenkins-agent-python-publish.yaml
index 3e5225243..0a3e0d8b3 100644
--- a/.github/workflows/jenkins-agent-python-publish.yaml
+++ b/.github/workflows/jenkins-agent-python-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/jenkins-agent-ruby-pr.yaml b/.github/workflows/jenkins-agent-ruby-pr.yaml
index 4ac5098cf..44f8c47bb 100644
--- a/.github/workflows/jenkins-agent-ruby-pr.yaml
+++ b/.github/workflows/jenkins-agent-ruby-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-ruby
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-rust-pr.yaml b/.github/workflows/jenkins-agent-rust-pr.yaml
index a182704a2..29f33e5f3 100644
--- a/.github/workflows/jenkins-agent-rust-pr.yaml
+++ b/.github/workflows/jenkins-agent-rust-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-rust
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-zap-pr.yaml b/.github/workflows/jenkins-agent-zap-pr.yaml
index 432c52b7d..a352f427e 100644
--- a/.github/workflows/jenkins-agent-zap-pr.yaml
+++ b/.github/workflows/jenkins-agent-zap-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-zap
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/rabbitmq-pr.yaml b/.github/workflows/rabbitmq-pr.yaml
index c8ea61931..0fb687125 100644
--- a/.github/workflows/rabbitmq-pr.yaml
+++ b/.github/workflows/rabbitmq-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: rabbitmq
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/rabbitmq-publish.yaml b/.github/workflows/rabbitmq-publish.yaml
index a5a6f7f4e..94bfe8b66 100644
--- a/.github/workflows/rabbitmq-publish.yaml
+++ b/.github/workflows/rabbitmq-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/s2i-mvn-gradle-pr.yaml b/.github/workflows/s2i-mvn-gradle-pr.yaml
index e17222d13..2025c6dc0 100644
--- a/.github/workflows/s2i-mvn-gradle-pr.yaml
+++ b/.github/workflows/s2i-mvn-gradle-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: s2i-mvn-gradle
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/sonarqube-pr.yaml b/.github/workflows/sonarqube-pr.yaml
index 7b5277dbf..7867449a4 100644
--- a/.github/workflows/sonarqube-pr.yaml
+++ b/.github/workflows/sonarqube-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: sonarqube
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/tekton-task-images-conftest-pr.yaml b/.github/workflows/tekton-task-images-conftest-pr.yaml
index ac9a16cd3..d72c5c29b 100644
--- a/.github/workflows/tekton-task-images-conftest-pr.yaml
+++ b/.github/workflows/tekton-task-images-conftest-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: conftest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -25,7 +25,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/tekton-task-images-conftest-publish.yaml b/.github/workflows/tekton-task-images-conftest-publish.yaml
index 33472a745..65a179b93 100644
--- a/.github/workflows/tekton-task-images-conftest-publish.yaml
+++ b/.github/workflows/tekton-task-images-conftest-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -27,7 +27,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -36,7 +36,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -47,7 +47,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/tekton-task-images-helm-pr.yaml b/.github/workflows/tekton-task-images-helm-pr.yaml
index 954bf587c..c4168ce1e 100644
--- a/.github/workflows/tekton-task-images-helm-pr.yaml
+++ b/.github/workflows/tekton-task-images-helm-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: helm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -25,7 +25,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/tekton-task-images-helm-publish.yaml b/.github/workflows/tekton-task-images-helm-publish.yaml
index 84423aeb8..518224f28 100644
--- a/.github/workflows/tekton-task-images-helm-publish.yaml
+++ b/.github/workflows/tekton-task-images-helm-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -27,7 +27,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -36,7 +36,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -47,7 +47,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/tookbox-pr.yaml b/.github/workflows/tookbox-pr.yaml
index 4f84bdd4a..8f4920d01 100644
--- a/.github/workflows/tookbox-pr.yaml
+++ b/.github/workflows/tookbox-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: toolbox
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi7-gitlab-runner-pr.yaml b/.github/workflows/ubi7-gitlab-runner-pr.yaml
index 7f7097b96..a6326d877 100644
--- a/.github/workflows/ubi7-gitlab-runner-pr.yaml
+++ b/.github/workflows/ubi7-gitlab-runner-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: ubi7-gitlab-runner
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi7-gitlab-runner-publish.yaml b/.github/workflows/ubi7-gitlab-runner-publish.yaml
index 44b2ecf72..7c376c5a6 100644
--- a/.github/workflows/ubi7-gitlab-runner-publish.yaml
+++ b/.github/workflows/ubi7-gitlab-runner-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-asciidoctor-pr.yaml b/.github/workflows/ubi8-asciidoctor-pr.yaml
index 84a611498..60dafdf92 100644
--- a/.github/workflows/ubi8-asciidoctor-pr.yaml
+++ b/.github/workflows/ubi8-asciidoctor-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: ubi8-asciidoctor
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -25,7 +25,7 @@ jobs:
           sudo apt-get install -y qemu-user-static
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-asciidoctor-publish.yaml b/.github/workflows/ubi8-asciidoctor-publish.yaml
index b287efc1b..d32f04bab 100644
--- a/.github/workflows/ubi8-asciidoctor-publish.yaml
+++ b/.github/workflows/ubi8-asciidoctor-publish.yaml
@@ -14,7 +14,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -29,7 +29,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -39,7 +39,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -50,7 +50,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-bats-pr.yaml b/.github/workflows/ubi8-bats-pr.yaml
index 624538c6b..8541b1a11 100644
--- a/.github/workflows/ubi8-bats-pr.yaml
+++ b/.github/workflows/ubi8-bats-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: ubi8-bats
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-bats-publish.yaml b/.github/workflows/ubi8-bats-publish.yaml
index bcf54ae42..5e2be560a 100644
--- a/.github/workflows/ubi8-bats-publish.yaml
+++ b/.github/workflows/ubi8-bats-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-git-pr.yaml b/.github/workflows/ubi8-git-pr.yaml
index bfac22fb6..84cd86219 100644
--- a/.github/workflows/ubi8-git-pr.yaml
+++ b/.github/workflows/ubi8-git-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: ubi8-git
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-git-publish.yaml b/.github/workflows/ubi8-git-publish.yaml
index b80b989d3..7afa73d6b 100644
--- a/.github/workflows/ubi8-git-publish.yaml
+++ b/.github/workflows/ubi8-git-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-google-api-python-client-pr.yaml b/.github/workflows/ubi8-google-api-python-client-pr.yaml
index 0a12f344b..b8fe36148 100644
--- a/.github/workflows/ubi8-google-api-python-client-pr.yaml
+++ b/.github/workflows/ubi8-google-api-python-client-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: ubi8-google-api-python-client
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
@@ -20,7 +20,7 @@ jobs:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-google-api-python-client-publish.yaml b/.github/workflows/ubi8-google-api-python-client-publish.yaml
index 0b2f69e57..33093b276 100644
--- a/.github/workflows/ubi8-google-api-python-client-publish.yaml
+++ b/.github/workflows/ubi8-google-api-python-client-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
@@ -22,7 +22,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/build-docker-generic/Dockerfile b/build-docker-generic/Dockerfile
index b4f1cac9c..e69786fcf 100644
--- a/build-docker-generic/Dockerfile
+++ b/build-docker-generic/Dockerfile
@@ -1,3 +1,3 @@
-FROM registry.access.redhat.com/ubi8
+FROM registry.access.redhat.com/ubi8@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 RUN touch /etc/testfile
\ No newline at end of file
diff --git a/build-s2i-gows/Dockerfile b/build-s2i-gows/Dockerfile
index 2344782bd..37f080700 100644
--- a/build-s2i-gows/Dockerfile
+++ b/build-s2i-gows/Dockerfile
@@ -1,4 +1,4 @@
-FROM redhatcop/gows:busybox
+FROM redhatcop/gows:busybox@sha256:f35f47252f291ebca134feb50b594a4d3be89fceac1de64ee3eae0a784264d35
 
 LABEL io.k8s.description="GoWS Web Server S2I Image" \
       io.k8s.display-name="GoWS Builder" \
diff --git a/build-s2i-jekyll/Dockerfile b/build-s2i-jekyll/Dockerfile
index dbadf5e7a..d5ca3d784 100644
--- a/build-s2i-jekyll/Dockerfile
+++ b/build-s2i-jekyll/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:2.4.0-alpine
+FROM ruby:2.4.0-alpine@sha256:49cd3c5e577ff2898fa7ff82271f4ccf1054d12adc7f7a6595da87b35f9f3972
 
 LABEL io.k8s.description="A Platform for Building Websites from Markdown" \
     io.k8s.display-name="Jekyll Builder" \
diff --git a/build-s2i-liberty/Dockerfile b/build-s2i-liberty/Dockerfile
index 729409654..82914bc74 100644
--- a/build-s2i-liberty/Dockerfile
+++ b/build-s2i-liberty/Dockerfile
@@ -1,7 +1,7 @@
 # This image provides a base for building and running WildFly applications.
 # It builds using maven and runs the resulting artifacts on WildFly 10.1.0 Final
 
-FROM websphere-liberty:webProfile8
+FROM websphere-liberty:webProfile8@sha256:7cce4e3c674e2f4c83452787ae1013e19fea4389dad7bb8bb32b95680c4b6e7e
 
 MAINTAINER Raffaele Spazzoli <rspazzol@redhat.com>
 
diff --git a/build-s2i-python-kopf/Dockerfile b/build-s2i-python-kopf/Dockerfile
index 5d34c6081..1fdfed39d 100644
--- a/build-s2i-python-kopf/Dockerfile
+++ b/build-s2i-python-kopf/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi9/python-311:latest
+FROM registry.access.redhat.com/ubi9/python-311:latest@sha256:286b53c35373ee34679e3c7d68a357785a509e14b18ea20d6ad3426af639c239
 
 MAINTAINER Johnathan Kupferer <jkupfere@redhat.com>
 
diff --git a/github-runner-ubi8/Dockerfile b/github-runner-ubi8/Dockerfile
index d78b4b23d..29b781637 100644
--- a/github-runner-ubi8/Dockerfile
+++ b/github-runner-ubi8/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/ubi:latest  
+FROM registry.access.redhat.com/ubi8/ubi:latest@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3  
 
 ARG GITHUB_RUNNER_VERSION="2.276.0"
 
diff --git a/hoverfly/Dockerfile b/hoverfly/Dockerfile
index bd740b69a..bc6500ac0 100644
--- a/hoverfly/Dockerfile
+++ b/hoverfly/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/ubi
+FROM registry.access.redhat.com/ubi8/ubi@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 ENV HOVERFLY_DOWNLOAD_URI https://github.com/SpectoLabs/hoverfly/releases/download/v1.2.0/hoverfly_bundle_linux_amd64.zip
 ENV HOME /home/hoverfly
diff --git a/jenkins-agents/jenkins-agent-ansible/Dockerfile b/jenkins-agents/jenkins-agent-ansible/Dockerfile
index 673ac0f0f..a81e87bac 100644
--- a/jenkins-agents/jenkins-agent-ansible/Dockerfile
+++ b/jenkins-agents/jenkins-agent-ansible/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 ARG ANSIBLE_VERSION=2.9.13
 
 LABEL \
diff --git a/jenkins-agents/jenkins-agent-arachni/Dockerfile b/jenkins-agents/jenkins-agent-arachni/Dockerfile
index 9abcbe4af..fdfaa7cf5 100644
--- a/jenkins-agents/jenkins-agent-arachni/Dockerfile
+++ b/jenkins-agents/jenkins-agent-arachni/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG VERSION=1.5.1
 ARG WEB_VERSION=0.5.12
diff --git a/jenkins-agents/jenkins-agent-argocd/Dockerfile b/jenkins-agents/jenkins-agent-argocd/Dockerfile
index add648538..b1e7c4436 100644
--- a/jenkins-agents/jenkins-agent-argocd/Dockerfile
+++ b/jenkins-agents/jenkins-agent-argocd/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ENV ARGOCD_VERSION=2.2.3 \
     YQ_VERSION=v4.16.2
diff --git a/jenkins-agents/jenkins-agent-conftest/Dockerfile b/jenkins-agents/jenkins-agent-conftest/Dockerfile
index 03fbd2dee..39b7a4174 100644
--- a/jenkins-agents/jenkins-agent-conftest/Dockerfile
+++ b/jenkins-agents/jenkins-agent-conftest/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/redhat-cop/jenkins-agent-python:v1.0
+FROM quay.io/redhat-cop/jenkins-agent-python:v1.0@sha256:6db6f00490699c05fe7412fad2c1d9f85dd30323f620eab2fc2af6ec0ff60d93
 # ^ needed to install the python yq library 🐍
 
 ARG BATS_VERSION=1.2.0
diff --git a/jenkins-agents/jenkins-agent-cosign/Dockerfile b/jenkins-agents/jenkins-agent-cosign/Dockerfile
index 9f4975214..40789a2fb 100644
--- a/jenkins-agents/jenkins-agent-cosign/Dockerfile
+++ b/jenkins-agents/jenkins-agent-cosign/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 USER root
 
diff --git a/jenkins-agents/jenkins-agent-erlang/Dockerfile b/jenkins-agents/jenkins-agent-erlang/Dockerfile
index 431e66029..925d9915c 100644
--- a/jenkins-agents/jenkins-agent-erlang/Dockerfile
+++ b/jenkins-agents/jenkins-agent-erlang/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG ERLANG_VERSION=22.1.4
 ARG REBAR3_VERSION=3.12.0
diff --git a/jenkins-agents/jenkins-agent-golang/Dockerfile b/jenkins-agents/jenkins-agent-golang/Dockerfile
index e4491ab8c..37c30a763 100644
--- a/jenkins-agents/jenkins-agent-golang/Dockerfile
+++ b/jenkins-agents/jenkins-agent-golang/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG GO_VERSION=1.15.6
 ARG SONAR_SCANNER_VERSION=4.5.0.2216
diff --git a/jenkins-agents/jenkins-agent-graalvm/Dockerfile b/jenkins-agents/jenkins-agent-graalvm/Dockerfile
index c09809aff..73503173c 100644
--- a/jenkins-agents/jenkins-agent-graalvm/Dockerfile
+++ b/jenkins-agents/jenkins-agent-graalvm/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-maven:4.9
+FROM quay.io/openshift/origin-jenkins-agent-maven:4.9@sha256:22e16191c77481a4f6f06ed7c2b33cead0c2631de5daa65cb1a6c174f41b7334
 ARG GRAAL_VERSION=20.3.3.0-Final
 ENV GRAALVM_HOME=/opt/mandrelJDK
 ENV GRAAL_CE_URL=https://github.com/graalvm/mandrel/releases/download/mandrel-${GRAAL_VERSION}/mandrel-java11-linux-amd64-${GRAAL_VERSION}.tar.gz
diff --git a/jenkins-agents/jenkins-agent-gradle/Dockerfile b/jenkins-agents/jenkins-agent-gradle/Dockerfile
index 28b83e2cc..ab1a0fc9e 100644
--- a/jenkins-agents/jenkins-agent-gradle/Dockerfile
+++ b/jenkins-agents/jenkins-agent-gradle/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ENV GRADLE_VERSION=6.3
 ENV GRADLE_USER_HOME=/home/jenkins/.gradle
diff --git a/jenkins-agents/jenkins-agent-helm/Dockerfile b/jenkins-agents/jenkins-agent-helm/Dockerfile
index 2ccbdc365..84a5ed703 100644
--- a/jenkins-agents/jenkins-agent-helm/Dockerfile
+++ b/jenkins-agents/jenkins-agent-helm/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG VERSION=3.5.2
 ARG YQ_VERSION=v4.5.1
diff --git a/jenkins-agents/jenkins-agent-hugo/Dockerfile b/jenkins-agents/jenkins-agent-hugo/Dockerfile
index e3db0024c..bff11869e 100644
--- a/jenkins-agents/jenkins-agent-hugo/Dockerfile
+++ b/jenkins-agents/jenkins-agent-hugo/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ENV HUGO_VERSION=0.83.1
 
diff --git a/jenkins-agents/jenkins-agent-image-mgmt/Dockerfile b/jenkins-agents/jenkins-agent-image-mgmt/Dockerfile
index d099725ed..cb9b87b90 100644
--- a/jenkins-agents/jenkins-agent-image-mgmt/Dockerfile
+++ b/jenkins-agents/jenkins-agent-image-mgmt/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/go-toolset:latest as builder
+FROM registry.access.redhat.com/ubi8/go-toolset:latest@sha256:c78305ff7360bdacdd790225ca10478e08dd6fcbc037bcd176acdf4a552995da as builder
 
 ARG SKOPEO_VERSION=1.5.2
 
@@ -9,7 +9,7 @@ RUN curl -L https://github.com/containers/skopeo/archive/v${SKOPEO_VERSION}.tar.
     cd /tmp/skopeo && \
     make BUILDTAGS=containers_image_openpgp DISABLE_DOCS=1 CGO_ENABLED=0 GO_DYN_FLAGS=
 
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG OC_VERSION=4.9
 
diff --git a/jenkins-agents/jenkins-agent-mongodb/Dockerfile b/jenkins-agents/jenkins-agent-mongodb/Dockerfile
index 67960a95a..a6efbc14f 100644
--- a/jenkins-agents/jenkins-agent-mongodb/Dockerfile
+++ b/jenkins-agents/jenkins-agent-mongodb/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 USER root
 
diff --git a/jenkins-agents/jenkins-agent-mvn/Dockerfile b/jenkins-agents/jenkins-agent-mvn/Dockerfile
index 42a523b47..c84f50e32 100644
--- a/jenkins-agents/jenkins-agent-mvn/Dockerfile
+++ b/jenkins-agents/jenkins-agent-mvn/Dockerfile
@@ -1,2 +1,2 @@
-FROM quay.io/openshift/origin-jenkins-agent-maven:4.9
+FROM quay.io/openshift/origin-jenkins-agent-maven:4.9@sha256:22e16191c77481a4f6f06ed7c2b33cead0c2631de5daa65cb1a6c174f41b7334
 ADD settings.xml $HOME/.m2/settings.xml
diff --git a/jenkins-agents/jenkins-agent-npm/Dockerfile b/jenkins-agents/jenkins-agent-npm/Dockerfile
index cafc3e3f7..1aa9c1a7b 100644
--- a/jenkins-agents/jenkins-agent-npm/Dockerfile
+++ b/jenkins-agents/jenkins-agent-npm/Dockerfile
@@ -1,5 +1,5 @@
 #invoke npm in jenkinsfile: sh "scl enable rh-nodejs6 'npm run build'"
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG JQ_VERSION=1.6
 ARG OC_VERSION=4.8
diff --git a/jenkins-agents/jenkins-agent-python/Dockerfile b/jenkins-agents/jenkins-agent-python/Dockerfile
index d416c1438..ff6a029c8 100644
--- a/jenkins-agents/jenkins-agent-python/Dockerfile
+++ b/jenkins-agents/jenkins-agent-python/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 EXPOSE 8080
 
diff --git a/jenkins-agents/jenkins-agent-ruby/Dockerfile b/jenkins-agents/jenkins-agent-ruby/Dockerfile
index 4901f2890..ce2f13237 100644
--- a/jenkins-agents/jenkins-agent-ruby/Dockerfile
+++ b/jenkins-agents/jenkins-agent-ruby/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 ARG RUBY_VERSION=2.7
 ARG OC_VERSION=4.9
diff --git a/jenkins-agents/jenkins-agent-rust/Dockerfile b/jenkins-agents/jenkins-agent-rust/Dockerfile
index c30ed37cf..6355178e0 100644
--- a/jenkins-agents/jenkins-agent-rust/Dockerfile
+++ b/jenkins-agents/jenkins-agent-rust/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/openshift/origin-jenkins-agent-base:4.9
+FROM quay.io/openshift/origin-jenkins-agent-base:4.9@sha256:94025d11174dbf836427236733d1b82010a21cf83c5321ec168db761fc2c28e7
 
 LABEL com.redhat.component="jenkins-agent-rust-ubi7-docker" \
       name="openshift/origin-jenkins-agent-rust-ubi7" \
diff --git a/jenkins-agents/jenkins-agent-zap/Dockerfile b/jenkins-agents/jenkins-agent-zap/Dockerfile
index c67ce2657..e38c11c8b 100644
--- a/jenkins-agents/jenkins-agent-zap/Dockerfile
+++ b/jenkins-agents/jenkins-agent-zap/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/centos/centos:centos7
+FROM quay.io/centos/centos:centos7@sha256:e4ca2ed0202e76be184e75fb26d14bf974193579039d5573fb2348664deef76e
 
 ARG ZAPROXY_VERSION="2.9.0"
 ARG WEBSWING_VERSION="22.2"
diff --git a/s2i-mvn-gradle/Dockerfile b/s2i-mvn-gradle/Dockerfile
index 3ad112861..98e7a6359 100644
--- a/s2i-mvn-gradle/Dockerfile
+++ b/s2i-mvn-gradle/Dockerfile
@@ -1,5 +1,5 @@
 # openjdk-gradle
-FROM registry.access.redhat.com/ubi8/ubi:latest
+FROM registry.access.redhat.com/ubi8/ubi:latest@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 # TODO: Put the maintainer name in the image metadata
 LABEL maintainer="Abhishek Singh <abhishek@linux.com>" \
diff --git a/sonarqube/Dockerfile b/sonarqube/Dockerfile
index 777b323b9..2767f5400 100644
--- a/sonarqube/Dockerfile
+++ b/sonarqube/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/sonarqube:latest
+FROM docker.io/sonarqube:latest@sha256:c9fc479ae8aca6393bc0e9852910bfdd14a001bcc37eca652290c1a5ca3b3ae6
 
 USER root
 
diff --git a/tool-box/Dockerfile b/tool-box/Dockerfile
index 3bc0fb0be..b4aaa7fee 100644
--- a/tool-box/Dockerfile
+++ b/tool-box/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8
+FROM registry.access.redhat.com/ubi8@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 ENV OC_VERSION=stable-4.12 \
     ROSA_VERSION=1.2.15 \
diff --git a/ubi7-gitlab-runner/Dockerfile b/ubi7-gitlab-runner/Dockerfile
index d014e9600..6884f3e52 100644
--- a/ubi7-gitlab-runner/Dockerfile
+++ b/ubi7-gitlab-runner/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi7
+FROM registry.access.redhat.com/ubi7@sha256:c5fc1825feb7ac82c5276b3b1ce3eb63266f937e9c0933ede41678332a99099f
 
 LABEL maintainer="Red Hat Services"
 
diff --git a/utilities/ubi8-asciidoctor/Dockerfile b/utilities/ubi8-asciidoctor/Dockerfile
index 7d3fc595b..ff562b9bd 100644
--- a/utilities/ubi8-asciidoctor/Dockerfile
+++ b/utilities/ubi8-asciidoctor/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8:latest
+FROM registry.access.redhat.com/ubi8:latest@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 LABEL MAINTAINERS="Red Hat Services"
 
diff --git a/utilities/ubi8-bats/Dockerfile b/utilities/ubi8-bats/Dockerfile
index 0fc081855..c5cd7af2b 100644
--- a/utilities/ubi8-bats/Dockerfile
+++ b/utilities/ubi8-bats/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal
+FROM registry.access.redhat.com/ubi8/ubi-minimal@sha256:87bcbfedfd70e67aab3875fff103bade460aeff510033ebb36b7efa009ab6639
 
 LABEL io.k8s.description="OCP Bats"
 LABEL io.k8s.display-name="OCP Bats"
diff --git a/utilities/ubi8-git/Dockerfile b/utilities/ubi8-git/Dockerfile
index cbd912ba5..570ad87c9 100644
--- a/utilities/ubi8-git/Dockerfile
+++ b/utilities/ubi8-git/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8
+FROM registry.access.redhat.com/ubi8@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 LABEL maintainer="Red Hat Services"
 
diff --git a/utilities/ubi8-google-api-python-client/Dockerfile b/utilities/ubi8-google-api-python-client/Dockerfile
index 7323b98ec..4b24fac76 100644
--- a/utilities/ubi8-google-api-python-client/Dockerfile
+++ b/utilities/ubi8-google-api-python-client/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi8
+FROM registry.access.redhat.com/ubi8@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
 
 LABEL maintainer="Red Hat Services"