diff --git a/.config/Dockerfile b/.config/Dockerfile
index 0c5e6e8e..e31e86cd 100644
--- a/.config/Dockerfile
+++ b/.config/Dockerfile
@@ -1,4 +1,4 @@
-ARG grafana_version=latest
+ARG grafana_version=latest@sha256:703b4a3aff457041dcbd15bf36dbc8bb83cb513b72b0912056985712be4c01bd
 ARG grafana_image=grafana-enterprise
 
 FROM grafana/${grafana_image}:${grafana_version}
diff --git a/.github/workflows/update-make-docs.yml b/.github/workflows/update-make-docs.yml
index cf61f169..cc56cf6e 100644
--- a/.github/workflows/update-make-docs.yml
+++ b/.github/workflows/update-make-docs.yml
@@ -12,10 +12,10 @@ jobs:
     if: github.repository == 'grafana/github-datasource'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
-      - uses: grafana/writers-toolkit/update-make-docs@update-make-docs/v1 # zizmor: ignore[unpinned-uses]
+      - uses: grafana/writers-toolkit/update-make-docs@f65819d6a412b752c0e0263375215f049507b0e6 # update-make-docs/v1 # zizmor: ignore[unpinned-uses]
         with:
           pr_options: >
             --label type/docs