diff --git a/Makefile b/Makefile
index c48a89b1c..92e2cd6ec 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ RELEASE_MSG ?= "koperator release"
 REL_TAG = $(shell ./scripts/increment_version.sh -${RELEASE_TYPE} ${TAG})
 
 # Version constants
-GOLANGCI_VERSION = 2.6.1 # renovate: datasource=github-releases depName=golangci/golangci-lint
+GOLANGCI_VERSION = 2.6.2 # renovate: datasource=github-releases depName=golangci/golangci-lint
 LICENSEI_VERSION = 0.9.0 # renovate: datasource=github-releases depName=goph/licensei
 CONTROLLER_GEN_VERSION = v0.19.0 # renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
 ENVTEST_K8S_VERSION = 1.34.1 # renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools extractVersion=^envtest-v(?<version>.+)$
diff --git a/docs/examples/springboot-kafka-avro/Dockerfile b/docs/examples/springboot-kafka-avro/Dockerfile
index 0294704fa..0858fe4ed 100644
--- a/docs/examples/springboot-kafka-avro/Dockerfile
+++ b/docs/examples/springboot-kafka-avro/Dockerfile
@@ -1,4 +1,4 @@
-FROM maven:3.9-eclipse-temurin-21-alpine as build
+FROM maven:3.9-eclipse-temurin-21-alpine@sha256:922927df2c662cdd47ddb116443d6bec4696cfae3de1a0ddac8fcc7b87ce61ae as build
 
 # Set working directory
 WORKDIR /usr/src/myapp
diff --git a/third_party/github.com/banzaicloud/go-cruise-control/deploy/docker-compose.yml b/third_party/github.com/banzaicloud/go-cruise-control/deploy/docker-compose.yml
index 61734fd91..22d034ff8 100644
--- a/third_party/github.com/banzaicloud/go-cruise-control/deploy/docker-compose.yml
+++ b/third_party/github.com/banzaicloud/go-cruise-control/deploy/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   zookeeper:
-    image: ghcr.io/adobe/zookeeper-operator/zookeeper:3.8.4-0.2.15-adobe-20250923
+    image: ghcr.io/adobe/zookeeper-operator/zookeeper:3.8.4-0.2.15-adobe-20250923@sha256:170e5b7a8e0156e414f18b9e2c4fa2331f80a3f587bab55ce28577e4d3d642b5
     restart: unless-stopped
     hostname: zookeeper
     container_name: zookeeper