diff --git a/docker/Dockerfile.windows.ltsc2025 b/docker/Dockerfile.windows.ltsc2025
index e0dbe7d..10412ab 100644
--- a/docker/Dockerfile.windows.ltsc2025
+++ b/docker/Dockerfile.windows.ltsc2025
@@ -17,7 +17,7 @@
 # Stage 1: download and extract PowerShell 7 on servercore.
 # servercore ships Windows PowerShell 5.1, which we use to run Invoke-WebRequest
 # and Expand-Archive to fetch the standalone PS7 ZIP release from GitHub.
-FROM mcr.microsoft.com/windows/servercore:ltsc2025 AS installer-env
+FROM mcr.microsoft.com/windows/servercore:ltsc2025@sha256:d5bbb83057f6bc2b6aeba5d01ec80a53003aba9bc84a6b1ebe780570cd52558a AS installer-env
 SHELL ["C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-Command"]
 RUN $ProgressPreference = 'SilentlyContinue'; `
     [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; `
@@ -25,7 +25,7 @@ RUN $ProgressPreference = 'SilentlyContinue'; `
     Expand-Archive C:\powershell.zip -DestinationPath C:\PowerShell
 
 # Stage 2: final nanoserver image with PowerShell 7 copied in.
-FROM mcr.microsoft.com/windows/nanoserver:ltsc2025
+FROM mcr.microsoft.com/windows/nanoserver:ltsc2025@sha256:fda578d34f56de2f60d91a178fd954fdc95596ebb67b3bc363deb708ef1fd94c
 USER ContainerAdministrator
 
 LABEL maintainer="Drone.IO Community <drone-dev@googlegroups.com>" `