diff --git a/.woodpecker/pr.yml b/.woodpecker/pr.yml
index 40a10da..5da54c9 100644
--- a/.woodpecker/pr.yml
+++ b/.woodpecker/pr.yml
@@ -7,13 +7,13 @@ when:
 
 steps:
   - name: lint
-    image: node:24-slim
+    image: node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2
     commands:
       - npm ci
       - npm run lint
 
   - name: test-coverage
-    image: node:24-slim
+    image: node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2
     commands:
       - npm ci
       - npm run test:coverage
diff --git a/.woodpecker/release.yml b/.woodpecker/release.yml
index 44aad5f..c25a68d 100644
--- a/.woodpecker/release.yml
+++ b/.woodpecker/release.yml
@@ -10,7 +10,7 @@ when:
 
 steps:
   - name: generate-dungeon
-    image: ghcr.io/puppeteer/puppeteer:latest
+    image: ghcr.io/puppeteer/puppeteer:latest@sha256:19d010877be7911acd7ad1795f603b4ca604c88c26848b81d1d9914e85a289e4
     environment:
       OLLAMA_API_URL:
         from_secret: OLLAMA_API_URL
@@ -23,7 +23,7 @@ steps:
       - npm start
 
   - name: upload-to-gitea-release
-    image: curlimages/curl:latest
+    image: curlimages/curl:latest@sha256:d94d07ba9e7d6de898b6d96c1a072f6f8266c687af78a74f380087a0addf5d17
     environment:
       GITEA_TOKEN:
         from_secret: GITEA_TOKEN
diff --git a/package.json b/package.json
index 488c451..b80844f 100644
--- a/package.json
+++ b/package.json
@@ -20,10 +20,10 @@
     "sharp": "^0.34.3"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.0",
-    "@vitest/coverage-v8": "^4.0.18",
-    "eslint": "^10.0.0",
-    "globals": "^17.0.0",
-    "vitest": "^4.0.18"
+    "@eslint/js": "10.0.1",
+    "@vitest/coverage-v8": "4.0.18",
+    "eslint": "10.0.1",
+    "globals": "17.3.0",
+    "vitest": "4.0.18"
   }
 }