diff --git a/.devcontainer/stack/valkey/compose.yml b/.devcontainer/stack/valkey/compose.yml
index 71328a2..f787011 100644
--- a/.devcontainer/stack/valkey/compose.yml
+++ b/.devcontainer/stack/valkey/compose.yml
@@ -2,7 +2,7 @@
 # containers on the compose-generated default network (see ../README.md).
 services:
   valkey:
-    image: valkey/valkey:9.1.2-alpine
+    image: valkey/valkey:9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
     restart: unless-stopped
     command: valkey-server --appendonly yes
     volumes:
diff --git a/Dockerfile b/Dockerfile
index 05ee5e5..4559aff 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.28
+# syntax=docker/dockerfile:1.28@sha256:bb22d9815c728170f72750f4e5b0d672e06176142e1d602c7e66c050100b7e5b
 # Runtime image (builder + bff-deploy -> runner), the repo's top-level
 # Dockerfile; the devcontainer image is `.devcontainer/Dockerfile`'s `develop`
 # stage.