diff --git a/confbatstest/Dockerfile b/confbatstest/Dockerfile
index ab64c92..f9679fc 100644
--- a/confbatstest/Dockerfile
+++ b/confbatstest/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/confbatstest:v4.3
+FROM ghcr.io/redhat-cop/github-actions/confbatstest:v4.3@sha256:d8b6b83631370b1cfda8dd41865d4bfda17f81d1f0b626e7357a10aa465f278e
diff --git a/github-dispatches/Dockerfile b/github-dispatches/Dockerfile
index b1f1410..38fa140 100644
--- a/github-dispatches/Dockerfile
+++ b/github-dispatches/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/github-dispatches:v4.3
+FROM ghcr.io/redhat-cop/github-actions/github-dispatches:v4.3@sha256:ab25a23e25232d5b4cccfdcc853440e24f6a26196edde3c5c99366885c87bba2
diff --git a/kyverno-cli/Dockerfile b/kyverno-cli/Dockerfile
index fa3d14f..26d2bd8 100644
--- a/kyverno-cli/Dockerfile
+++ b/kyverno-cli/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/kyverno-cli:v4.3
+FROM ghcr.io/redhat-cop/github-actions/kyverno-cli:v4.3@sha256:0c25beba9cf2d26b3a7586b741d481d7ad168ec957b4660bea8faf47baf44128
diff --git a/redhat-csp-download/Dockerfile b/redhat-csp-download/Dockerfile
index e6f4df1..41ad315 100644
--- a/redhat-csp-download/Dockerfile
+++ b/redhat-csp-download/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/redhat-csp-download:v4.3
+FROM ghcr.io/redhat-cop/github-actions/redhat-csp-download:v4.3@sha256:936c5330bb1a37ecf52c42fee06d31d8c573b929f55cf82d4ead47b3e6e26ad9
diff --git a/ssh-agent/package.json b/ssh-agent/package.json
index 785468c..7e6241b 100644
--- a/ssh-agent/package.json
+++ b/ssh-agent/package.json
@@ -16,11 +16,11 @@
     "@actions/core": "1.10.1"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.1.0",
-    "@eslint/js": "^9.7.0",
+    "@eslint/eslintrc": "3.1.0",
+    "@eslint/js": "9.7.0",
     "@vercel/ncc": "0.38.1",
     "eslint-config-prettier": "9.1.0",
-    "globals": "^15.8.0",
+    "globals": "15.8.0",
     "prettier": "3.3.3"
   }
 }