diff --git a/confbatstest/Dockerfile b/confbatstest/Dockerfile
index 456535b..1bbac47 100644
--- a/confbatstest/Dockerfile
+++ b/confbatstest/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/confbatstest:v4.4.0
+FROM ghcr.io/redhat-cop/github-actions/confbatstest:v4.4.0@sha256:9dd2118efbdeb347066b31bb111e2c9a7972c1844ae7b8bd1745bd48e1867ea2
diff --git a/github-dispatches/Dockerfile b/github-dispatches/Dockerfile
index 2fa279e..8cd577d 100644
--- a/github-dispatches/Dockerfile
+++ b/github-dispatches/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/github-dispatches:v4.4.0
+FROM ghcr.io/redhat-cop/github-actions/github-dispatches:v4.4.0@sha256:ff22df6a117e5bc1d7ff06d126c7e20d08fcee6acaa4094ee319d5508d67c682
diff --git a/kyverno-cli/Dockerfile b/kyverno-cli/Dockerfile
index 11507d2..35e1b52 100644
--- a/kyverno-cli/Dockerfile
+++ b/kyverno-cli/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/kyverno-cli:v4.4.0
+FROM ghcr.io/redhat-cop/github-actions/kyverno-cli:v4.4.0@sha256:0fc78e89d82a8f35a6fae7c07a3e46f8e7dee25e0c130d96360fd4439478180e
diff --git a/redhat-csp-download/Dockerfile b/redhat-csp-download/Dockerfile
index b7d30a4..bd05d7c 100644
--- a/redhat-csp-download/Dockerfile
+++ b/redhat-csp-download/Dockerfile
@@ -1,2 +1,2 @@
 # renovate: datasource=github-releases depName=redhat-cop/github-actions
-FROM ghcr.io/redhat-cop/github-actions/redhat-csp-download:v4.4.0
+FROM ghcr.io/redhat-cop/github-actions/redhat-csp-download:v4.4.0@sha256:df6e126ade2f52ebe45efe13f2cd7c825bd6a2203086c1fee4cc7b7d87ab11b0