diff --git a/Dockerfile b/Dockerfile
index 55c66a5..2083384 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,13 @@
-FROM node:22-alpine AS build
+# node:22-alpine as of 2026-02-22
+FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS build
 WORKDIR /app
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile
 COPY . .
 RUN yarn build
 
-FROM nginx:stable-alpine
+# nginx:stable-alpine as of 2026-02-22
+FROM nginx@sha256:15e96e59aa3b0aada3a121296e3bce117721f42d88f5f64217ef4b18f458c6ab
 # Remove default config
 RUN rm /etc/nginx/conf.d/default.conf
 # Custom nginx config: real_ip from RFC1918, access_log to stdout