diff --git a/Release.gitlab-ci.yml b/Release.gitlab-ci.yml
index 74f288f..39224b1 100644
--- a/Release.gitlab-ci.yml
+++ b/Release.gitlab-ci.yml
@@ -20,7 +20,7 @@ unbound_release_preconditions_failed:
 unbound_release_changelog:
   stage: .pre
   image:
-    name: orhunp/git-cliff:latest
+    name: orhunp/git-cliff:latest@sha256:1847ae4b7cc81244bcdd7f6e8e594d63ad1e66ff6d15407f1d064d7b7f184de1
     entrypoint: [ "" ]
   variables:
     GIT_STRATEGY: clone # clone entire repo instead of reusing workspace
@@ -45,7 +45,7 @@ unbound_release_changelog:
 
 unbound_release_handle_mr:
   stage: .pre
-  image: alpine:latest
+  image: alpine:latest@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d
   needs:
   - unbound_release_changelog
   before_script:
@@ -141,7 +141,7 @@ unbound_release_handle_mr:
 unbound_release_prepare_release:
   stage: .pre
   image:
-    name: orhunp/git-cliff:latest
+    name: orhunp/git-cliff:latest@sha256:1847ae4b7cc81244bcdd7f6e8e594d63ad1e66ff6d15407f1d064d7b7f184de1
     entrypoint: [ "" ]
   variables:
     GIT_STRATEGY: clone # clone entire repo instead of reusing workspace
@@ -170,7 +170,7 @@ unbound_release_prepare_release:
 
 unbound_release_create_release:
   stage: .pre
-  image: alpine:latest
+  image: alpine:latest@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d
   needs:
   - unbound_release_prepare_release
   before_script:
@@ -202,7 +202,7 @@ unbound_release_create_release:
 
 unbound_release_tag:
   stage: .pre
-  image: alpine:latest
+  image: alpine:latest@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d
   needs:
   - unbound_release_prepare_release
   before_script: