diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index be7cc2b..d533b33 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,7 +16,7 @@ jobs:
     environment: auto-build
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Set up Ruby
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index c38719b..d24a084 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -21,12 +21,12 @@ jobs:
           - outscale-go.yaml
           - outscale-java.yaml
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           sparse-checkout: ${{ matrix.spec }}
           path: ./base
           ref: ${{ github.base_ref }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           sparse-checkout: ${{ matrix.spec }}
           path: ./revision
@@ -43,7 +43,7 @@ jobs:
     continue-on-error: true
     steps:
       # Check out the repository
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       # Run Spectral
       - uses: stoplightio/spectral-action@6416fd018ae38e60136775066eb3e98172143141 # latest
diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml
index a625ff2..d0a933b 100644
--- a/.github/workflows/cred-scan.yml
+++ b/.github/workflows/cred-scan.yml
@@ -12,8 +12,8 @@ jobs:
   cred-scan:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Scan credentials
-      uses: outscale/cred-scan@main
+      uses: outscale/cred-scan@36ef82cc690d72a17bf0993ab323961f1b1f9c66 # main
       with:
         scan_path: "./"
diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml
index faddb67..c987f85 100644
--- a/.github/workflows/github-sanity-scan.yml
+++ b/.github/workflows/github-sanity-scan.yml
@@ -12,8 +12,8 @@ jobs:
   github-sanity-scan:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Github sanity scanner
-      uses: outscale/github-sanity-scan@main
+      uses: outscale/github-sanity-scan@380a9927b4be45d9c4f6f66a4e8dfd7cf7b18513 # main
       with:
         no-pull-request-target: true
diff --git a/.github/workflows/release-osc-api.yml b/.github/workflows/release-osc-api.yml
index f34cede..a1762c3 100644
--- a/.github/workflows/release-osc-api.yml
+++ b/.github/workflows/release-osc-api.yml
@@ -11,7 +11,7 @@ jobs:
   osc-sdk-go:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Getting release details
@@ -31,7 +31,7 @@ jobs:
   osc-sdk-python:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Getting release details
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Getting release details
@@ -60,7 +60,7 @@ jobs:
   osc-sdk-rust:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Getting release details
@@ -74,7 +74,7 @@ jobs:
   osc-sdk-js:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Getting release details
@@ -88,7 +88,7 @@ jobs:
   osc-sdk-java:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
       - name: Getting release details
diff --git a/hacks/Dockerfile b/hacks/Dockerfile
index f769907..e4b0713 100644
--- a/hacks/Dockerfile
+++ b/hacks/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.3-slim
+FROM ruby:3.3-slim@sha256:db3ad6dd68a886d51a187fb9bf486052f2976cdbe3b750169c25092aba1297fa
 
 WORKDIR /usr/src/app