diff --git a/.devcontainer.json b/.devcontainer.json
index 80561bc..97f468a 100644
--- a/.devcontainer.json
+++ b/.devcontainer.json
@@ -2,7 +2,7 @@
 // https://github.com/microsoft/vscode-dev-containers/tree/v0.177.0/containers/typescript-node
 {
   "name": "Open Home Foundation - API",
-  "image": "mcr.microsoft.com/devcontainers/typescript-node:24-bookworm",
+  "image": "mcr.microsoft.com/devcontainers/typescript-node:24-bookworm@sha256:7f4046f8149ced6dbb5f79089bfac97a300627f9e08f91a47237b555e730e71c",
   "forwardPorts": [3000],
   "portsAttributes": {
     "3000": {
diff --git a/Dockerfile b/Dockerfile
index a2eec0b..f492247 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.25
+# syntax=docker/dockerfile:1.25@sha256:0adf442eae370b6087e08edc7c50b552d80ddf261576f4ebd6421006b2461f12
 
 # Both stages pin the same digest, so a build is reproducible and a tag that
 # moves under us cannot change what we ship. It is the multi-platform index