diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 9525e34..ac712d5 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -9,11 +9,11 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: git.kjan.de/actions/zmk-builder:latest
+      image: git.kjan.de/actions/zmk-builder:latest@sha256:04846653fc9d22a0f12081d838e347762cd2721210738a5408929b3ae9a9f154
     name: Build
     steps:                
       - name: Checkout
-        uses: https://git.kjan.de/actions/checkout@v4
+        uses: https://git.kjan.de/actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Hash west modules
         id: hash-west
@@ -25,7 +25,7 @@ jobs:
           echo "computed hash: $HASH"                    
 
       - name: Cache west modules
-        uses: https://git.kjan.de/actions/cache@v4
+        uses: https://git.kjan.de/actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         env:
           cache-name: cache-zephyr-modules
         with:
@@ -85,7 +85,7 @@ jobs:
           echo "computed hash: $HASH"                    
 
       - name: Upload Artifact
-        uses: https://git.kjan.de/actions/upload-artifact@v3
+        uses: https://git.kjan.de/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           path: firmware/
           name: firmware