diff --git a/Dockerfile b/Dockerfile
index fa626c5..b67f1c4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,7 @@
-FROM golang:1.24-alpine AS builder
+# golang:1.24-alpine, 2026-02-26
+FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
 
-RUN apk add --no-cache git
+RUN apk add --no-cache git build-base
 
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -8,10 +9,15 @@ RUN go mod download
 
 COPY . .
 
+# Run all checks — build fails if branch is not green
+RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+RUN make check
+
 ARG VERSION=dev
 RUN go build -ldflags "-X main.Version=${VERSION}" -o /chatd ./cmd/chatd
 
-FROM alpine:3.21
+# alpine:3.21, 2026-02-26
+FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 
 RUN apk add --no-cache ca-certificates
 COPY --from=builder /chatd /usr/local/bin/chatd