diff --git a/Dockerfile b/Dockerfile
index d26142441a94..7a8a52f64aee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:latest
+FROM node:latest@sha256:b98ec1c96103fbe1a9e449b3854bbc0a0ed1c5936882ae0939d4c3a771265b4b
 
 ENV NODE_OPTIONS=--openssl-legacy-provider
 
diff --git a/package.json b/package.json
index bf56882a22db..699478a71dc2 100644
--- a/package.json
+++ b/package.json
@@ -119,10 +119,10 @@
     "@sourcegraph/eslint-config": "^0.26.0",
     "@sourcegraph/prettierrc": "^3.0.3",
     "@sourcegraph/tsconfig": "^4.0.1",
-    "@types/hast": "^2.3.4",
+    "@types/hast": "2.3.4",
     "@types/line-column": "1.0.0",
-    "@types/mdast": "^3.0.10",
-    "@types/node": "^18.11.18",
+    "@types/mdast": "3.0.10",
+    "@types/node": "18.11.18",
     "@types/react": "18.0.0",
     "@types/relateurl": "0.2.29",
     "ajv-cli": "^5.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e7a63705e6fc..59e6fd8b2adb 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -143,16 +143,16 @@ devDependencies:
     specifier: ^4.0.1
     version: 4.0.1
   '@types/hast':
-    specifier: ^2.3.4
+    specifier: 2.3.4
     version: 2.3.4
   '@types/line-column':
     specifier: 1.0.0
     version: 1.0.0
   '@types/mdast':
-    specifier: ^3.0.10
+    specifier: 3.0.10
     version: 3.0.10
   '@types/node':
-    specifier: ^18.11.18
+    specifier: 18.11.18
     version: 18.11.18
   '@types/react':
     specifier: 18.0.0