diff --git a/.github/workflows/core-bootstrap---go-build.yml b/.github/workflows/core-bootstrap---go-build.yml
index b1fbb23..db17e17 100644
--- a/.github/workflows/core-bootstrap---go-build.yml
+++ b/.github/workflows/core-bootstrap---go-build.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   docker-build:
     if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}
-    uses: Netcracker/qubership-core-infra/.github/workflows/docker-build.yaml@v2.4.1
+    uses: Netcracker/qubership-core-infra/.github/workflows/docker-build.yaml@bc2a0bd082147e23b4091616c608a21cc2957728 # v2.4.1
     with:
       dry-run: false
       config-filename: "core-bootstrap---docker-dev-config.json"
\ No newline at end of file
diff --git a/.github/workflows/coretpl---publish-release.yaml b/.github/workflows/coretpl---publish-release.yaml
index 56e1e9e..9351c47 100644
--- a/.github/workflows/coretpl---publish-release.yaml
+++ b/.github/workflows/coretpl---publish-release.yaml
@@ -70,7 +70,7 @@ jobs:
           fi
 
       - name: Set up Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
         with:
           version: v3.14.0
 
diff --git a/.github/workflows/cr-synchronizer---go-build.yml b/.github/workflows/cr-synchronizer---go-build.yml
index de11905..5c87a80 100644
--- a/.github/workflows/cr-synchronizer---go-build.yml
+++ b/.github/workflows/cr-synchronizer---go-build.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   docker-build:
     if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}
-    uses: Netcracker/qubership-core-infra/.github/workflows/docker-build.yaml@v2.4.1
+    uses: Netcracker/qubership-core-infra/.github/workflows/docker-build.yaml@bc2a0bd082147e23b4091616c608a21cc2957728 # v2.4.1
     with:
       dry-run: false
       config-filename: "cr-synchronizer---docker-dev-config.json"
\ No newline at end of file
diff --git a/.github/workflows/link-checker.yaml b/.github/workflows/link-checker.yaml
index 70d9f78..2918fd5 100644
--- a/.github/workflows/link-checker.yaml
+++ b/.github/workflows/link-checker.yaml
@@ -27,7 +27,7 @@ jobs:
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
         with:
           args: >-
             './**/*.md'
diff --git a/core-bootstrap/Dockerfile b/core-bootstrap/Dockerfile
index d451485..06da7ed 100644
--- a/core-bootstrap/Dockerfile
+++ b/core-bootstrap/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26 AS build
+FROM golang:1.26@sha256:6df14f4a4bc9d979a3721f488981e0d1b318006377e473ed23d026796f5f4c0a AS build
 
 WORKDIR /app
 
@@ -7,7 +7,7 @@ COPY . .
 RUN go mod download
 RUN go build -o platform-bootstrap-image .
 
-FROM ghcr.io/netcracker/qubership-core-base:2.2.13 AS run
+FROM ghcr.io/netcracker/qubership-core-base:2.2.13@sha256:39304438e598101578f91d84bc58699fd1a3f717a46b786cb43523735826e7b4 AS run
 
 COPY --chown=10001:0 --chmod=555 --from=build app/platform-bootstrap-image /app/platform-bootstrap-image
 
diff --git a/cr-synchronizer/Dockerfile b/cr-synchronizer/Dockerfile
index fe4a31b..1d5acb6 100644
--- a/cr-synchronizer/Dockerfile
+++ b/cr-synchronizer/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26 AS build
+FROM golang:1.26@sha256:6df14f4a4bc9d979a3721f488981e0d1b318006377e473ed23d026796f5f4c0a AS build
 
 WORKDIR /app
 
@@ -7,7 +7,7 @@ COPY . .
 RUN go mod download
 RUN go build -o cr-synchronizer .
 
-FROM ghcr.io/netcracker/qubership-core-base:2.2.13 AS run
+FROM ghcr.io/netcracker/qubership-core-base:2.2.13@sha256:39304438e598101578f91d84bc58699fd1a3f717a46b786cb43523735826e7b4 AS run
 
 COPY --chown=10001:0 --chmod=555 --from=build app/cr-synchronizer /app/cr-checker