diff --git a/Dockerfile b/Dockerfile
index 24cc58e40..af70ef575 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.25-alpine AS builder
+FROM golang:1.25.11-alpine3.22@sha256:65b4400aee0927412e9ed791a11893273a49d55df24841f7599660fb80dae464 AS builder
 
 WORKDIR /app
 
@@ -17,7 +17,7 @@ ARG VERSION=dev
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o awmg .
 
 # Runtime stage
-FROM alpine:latest
+FROM alpine:3.22.5@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
 
 # Install Docker CLI and bash for launching backend MCP servers
 RUN apk add --no-cache docker-cli bash
diff --git a/dockerfile_test.go b/dockerfile_test.go
new file mode 100644
index 000000000..623ecfac2
--- /dev/null
+++ b/dockerfile_test.go
@@ -0,0 +1,32 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	pinnedBuilderPattern = regexp.MustCompile(`(?m)^FROM golang:\d+\.\d+(?:\.\d+)?-alpine\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64} AS builder$`)
+	pinnedRuntimePattern = regexp.MustCompile(`(?m)^FROM alpine:\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64}$`)
+)
+
+func TestDockerfileUsesPinnedBaseImages(t *testing.T) {
+	t.Parallel()
+
+	_, thisFile, _, ok := runtime.Caller(0)
+	require.True(t, ok, "runtime.Caller should resolve this test file path")
+
+	dockerfilePath := filepath.Join(filepath.Dir(thisFile), "Dockerfile")
+	content, err := os.ReadFile(dockerfilePath)
+	require.NoError(t, err)
+
+	dockerfile := string(content)
+	assert.Regexp(t, pinnedBuilderPattern, dockerfile)
+	assert.Regexp(t, pinnedRuntimePattern, dockerfile)
+}