diff --git a/Dockerfile b/Dockerfile
index 807e9f3..c73da07 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,7 @@ COPY pkg/ pkg/
 # Build the controller.
 RUN make build/git-cert-shim CGO_ENABLED=0
 
-FROM --platform=${BUILDPLATFORM:-linux/amd64} alpine:3.22
+FROM --platform=${BUILDPLATFORM:-linux/amd64} alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
 LABEL source_repository="https://github.com/sapcc/git-cert-shim"
 
 WORKDIR /
diff --git a/config/controller/kustomization.yaml b/config/controller/kustomization.yaml
index 3a4d03d..03351ed 100644
--- a/config/controller/kustomization.yaml
+++ b/config/controller/kustomization.yaml
@@ -25,4 +25,4 @@ secretGenerator:
 images:
 - name: git-cert-shim
   newName: ghcr.io/sapcc/git-cert-shim
-  newTag: v2.2.1
+  newTag: v2.2.1@sha256:df140f950af3fe06a6e0c20c59bc6879b549bfb17661dd69e883aa52879fdcfd