diff --git a/.github/workflows/lsif.yml b/.github/workflows/lsif.yml
index 8040ec89c716..85c84c8c77bf 100644
--- a/.github/workflows/lsif.yml
+++ b/.github/workflows/lsif.yml
@@ -8,7 +8,7 @@ jobs:
   lsif-go:
     if: github.repository == 'sourcegraph/deploy-sourcegraph'
     runs-on: ubuntu-latest
-    container: sourcegraph/lsif-go
+    container: sourcegraph/lsif-go@sha256:2194d2652862966f022b537ed81bccf5a9a535ab763534cb4e98a3083c8a1bc6
     steps:
       - uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # renovate: tag=v1
       - name: Generate LSIF data
diff --git a/.github/workflows/pr-auditor.yml b/.github/workflows/pr-auditor.yml
index 14e2d304d008..b13146f19b9a 100644
--- a/.github/workflows/pr-auditor.yml
+++ b/.github/workflows/pr-auditor.yml
@@ -7,10 +7,10 @@ jobs:
   check-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           repository: 'sourcegraph/pr-auditor'
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4
         with: { go-version: '1.20' }
 
       - run: './check-pr.sh'
diff --git a/configure/executors/private-docker-registry/private-docker-registry.Deployment.yaml b/configure/executors/private-docker-registry/private-docker-registry.Deployment.yaml
index 48a56fa7cfcb..5f445694dd06 100644
--- a/configure/executors/private-docker-registry/private-docker-registry.Deployment.yaml
+++ b/configure/executors/private-docker-registry/private-docker-registry.Deployment.yaml
@@ -19,7 +19,7 @@ spec:
         app: private-docker-registry
     spec:
       containers:
-        - image: index.docker.io/registry:2
+        - image: index.docker.io/registry:2@sha256:d5f2fb0940fe9371b6b026b9b66ad08d8ab7b0d56b6ee8d5c71cb9b45a374307
           name: private-docker-registry
           imagePullPolicy: IfNotPresent
           env: