diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index f1cfb81d1f..30bd6847ed 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -164,7 +164,7 @@ jobs:
       pkg_type: deb
       artifact_name: xrpld-ubuntu-jammy-gcc-12-amd64-release
       version: ${{ needs.generate-version.outputs.version }}
-      container_image: ghcr.io/xrplf/ci/ubuntu-jammy:gcc-12
+      container_image: ghcr.io/xrplf/ci/ubuntu-jammy:gcc-12@sha256:14e463a9a88060b5a1e579204525c4a6f23afdd0255446f8e4f5415ae0cedac6
 
   package-rpm:
     needs: [should-run, build-test, generate-version]
@@ -173,7 +173,7 @@ jobs:
       pkg_type: rpm
       artifact_name: xrpld-rhel-9-gcc-12-amd64-release
       version: ${{ needs.generate-version.outputs.version }}
-      container_image: ghcr.io/xrplf/ci/rhel-9:gcc-12
+      container_image: ghcr.io/xrplf/ci/rhel-9:gcc-12@sha256:196f97b62b8352da1b7cfa91c59d442cc4940eae89a05b547408f62cbddcb8b3
 
   upload-recipe:
     needs:
diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml
index 4f48bb2507..d508f19847 100644
--- a/.github/workflows/on-tag.yml
+++ b/.github/workflows/on-tag.yml
@@ -60,7 +60,7 @@ jobs:
       pkg_type: deb
       artifact_name: xrpld-ubuntu-jammy-gcc-12-amd64-release
       version: ${{ needs.generate-version.outputs.version }}
-      container_image: ghcr.io/xrplf/ci/ubuntu-jammy:gcc-12
+      container_image: ghcr.io/xrplf/ci/ubuntu-jammy:gcc-12@sha256:14e463a9a88060b5a1e579204525c4a6f23afdd0255446f8e4f5415ae0cedac6
 
   package-rpm:
     needs: [build-test, generate-version]
@@ -69,4 +69,4 @@ jobs:
       pkg_type: rpm
       artifact_name: xrpld-rhel-9-gcc-12-amd64-release
       version: ${{ needs.generate-version.outputs.version }}
-      container_image: ghcr.io/xrplf/ci/rhel-9:gcc-12
+      container_image: ghcr.io/xrplf/ci/rhel-9:gcc-12@sha256:196f97b62b8352da1b7cfa91c59d442cc4940eae89a05b547408f62cbddcb8b3
diff --git a/.github/workflows/on-trigger.yml b/.github/workflows/on-trigger.yml
index 85c7eedb5b..0962780f7a 100644
--- a/.github/workflows/on-trigger.yml
+++ b/.github/workflows/on-trigger.yml
@@ -123,7 +123,7 @@ jobs:
       pkg_type: deb
       artifact_name: xrpld-ubuntu-jammy-gcc-12-amd64-release
       version: ${{ needs.generate-version.outputs.version }}
-      container_image: ghcr.io/xrplf/ci/ubuntu-jammy:gcc-12
+      container_image: ghcr.io/xrplf/ci/ubuntu-jammy:gcc-12@sha256:14e463a9a88060b5a1e579204525c4a6f23afdd0255446f8e4f5415ae0cedac6
 
   package-rpm:
     needs: [build-test, generate-version]
@@ -132,4 +132,4 @@ jobs:
       pkg_type: rpm
       artifact_name: xrpld-rhel-9-gcc-12-amd64-release
       version: ${{ needs.generate-version.outputs.version }}
-      container_image: ghcr.io/xrplf/ci/rhel-9:gcc-12
+      container_image: ghcr.io/xrplf/ci/rhel-9:gcc-12@sha256:196f97b62b8352da1b7cfa91c59d442cc4940eae89a05b547408f62cbddcb8b3
diff --git a/cmake/XrplPackaging.cmake b/cmake/XrplPackaging.cmake
index 4d4ae4f15b..852486a5ca 100644
--- a/cmake/XrplPackaging.cmake
+++ b/cmake/XrplPackaging.cmake
@@ -69,8 +69,12 @@ if(NOT DOCKER_EXECUTABLE)
     return()
 endif()
 
-set(DEB_TEST_IMAGE "geerlingguy/docker-ubuntu2204-ansible:latest")
-set(RPM_TEST_IMAGE "geerlingguy/docker-rockylinux9-ansible:latest")
+set(DEB_TEST_IMAGE
+    "geerlingguy/docker-ubuntu2204-ansible@sha256:bbe4c56c16c57c902554b9a47833590926b7a7d4440aef3d9851473b9f7be9d4"
+)
+set(RPM_TEST_IMAGE
+    "geerlingguy/docker-rockylinux9-ansible@sha256:790c2db9add93c0daa903ace816f352c9c04abb046ecfa12c581e8d4c59f41d6"
+)
 
 foreach(PKG deb rpm)
     if(PKG STREQUAL "deb")