diff --git a/test/cri-containerd/test-images/argsescaped/dockerfile b/test/cri-containerd/test-images/argsescaped/dockerfile
index cb90bb9e8c..b5bc03e93a 100644
--- a/test/cri-containerd/test-images/argsescaped/dockerfile
+++ b/test/cri-containerd/test-images/argsescaped/dockerfile
@@ -1,4 +1,5 @@
 # Test image for ArgsEscaped behavior.
-FROM mcr.microsoft.com/windows/nanoserver:1809
+# cplatpublic.azurecr.io/argsescaped:latest
+FROM mcr.microsoft.com/windows/nanoserver:1809@sha256:18dc202bc15c4ab948a993a021b554e70a5bc8f9f854a0674b3f5467cc7092da
 ENTRYPOINT cmd.exe /c
-CMD ping -t 127.0.0.1
\ No newline at end of file
+CMD ping -t 127.0.0.1
diff --git a/test/cri-containerd/test-images/imagepull_timestamp/Dockerfile b/test/cri-containerd/test-images/imagepull_timestamp/Dockerfile
index 6294e53ec0..7d76a0c07f 100644
--- a/test/cri-containerd/test-images/imagepull_timestamp/Dockerfile
+++ b/test/cri-containerd/test-images/imagepull_timestamp/Dockerfile
@@ -1,15 +1,15 @@
 # This Dockerfile builds a docker image based on top of the nanoserver image that is
-# used during the pull image tests in hcsshim. Tests in hcsshim/test/pullimage_test.go
+# used during the pull image tests in hcsshim. Tests in hcsshim/test/cri-containerd/pullimage_test.go
 # are directly dependent on the directory structure of this image. If anything is changed
 # in this Dockerfile, please make sure to update the tests too.
 
 # As of now this image is built with:
-# `docker build -t mtbar131/hcsshim:nanoserver_test .`
+# `docker build -t cplatpublic.azurecr.io/timestamp:latest .`
 # And this image is pushed to a private repo with:
-# `docker push mtbar131/hcsshim:nanoserver_test`
+# `docker push cplatpublic.azurecr.io/timestamp:latest`
 
 # Base image
-FROM mcr.microsoft.com/windows/nanoserver:1909
+FROM mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:56a7c823d8aed810849a38f47d995a727bf3de1ec611394025e1de24898a9622
 # Get administrator privileges
 USER containeradministrator
 
@@ -20,4 +20,4 @@ RUN mklink /d C:\Users\Public\fakelink C:\abcd
 # layer. The tests verify that even after file deletion in a layer timestamps are updated
 # correcty.
 RUN mkdir C:\Users\Public\testdir && echo "Windows Layer timestamp test" > C:\Users\Public\testdir\test.txt
-RUN del /q C:\Users\Public\testdir\test.txt
\ No newline at end of file
+RUN del /q C:\Users\Public\testdir\test.txt
diff --git a/test/cri-containerd/test-images/nanoserver-gracefultermination-repro/latest/Dockerfile b/test/cri-containerd/test-images/nanoserver-gracefultermination-repro/latest/Dockerfile
index 336e9c65e1..b1a2935b8a 100644
--- a/test/cri-containerd/test-images/nanoserver-gracefultermination-repro/latest/Dockerfile
+++ b/test/cri-containerd/test-images/nanoserver-gracefultermination-repro/latest/Dockerfile
@@ -1,3 +1,7 @@
+# Test image for graceful termination CRI integration tests.
+# `docker build -t cplatpublic.azurecr.io/nanoserver-gracefultermination-repro:latest .`
+# `docker push cplatpublic.azurecr.io/nanoserver-gracefultermination-repro:latest`
+
 FROM  golang:latest as build
 ENV GOOS=windows
 ENV GOARCH=amd64
@@ -6,7 +10,7 @@ WORKDIR /app
 COPY ./delayed-shutdown.go ./
 RUN go build -o delayed-shutdown.exe
 
-FROM mcr.microsoft.com/windows/nanoserver:ltsc2022
+FROM mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:56a7c823d8aed810849a38f47d995a727bf3de1ec611394025e1de24898a9622
 WORKDIR /app
 COPY --from=build /app/delayed-shutdown.exe .
 ENTRYPOINT ["delayed-shutdown.exe"]
diff --git a/test/cri-containerd/test-images/servercore-gracefultermination-repro/latest/Dockerfile b/test/cri-containerd/test-images/servercore-gracefultermination-repro/latest/Dockerfile
index 7fc6cd03d5..5620857d68 100644
--- a/test/cri-containerd/test-images/servercore-gracefultermination-repro/latest/Dockerfile
+++ b/test/cri-containerd/test-images/servercore-gracefultermination-repro/latest/Dockerfile
@@ -1,3 +1,7 @@
+# Test image for graceful termination CRI integration tests.
+# `docker build -t cplatpublic.azurecr.io/servercore-gracefultermination-repro:latest .`
+# `docker push cplatpublic.azurecr.io/servercore-gracefultermination-repro:latest`
+
 FROM  golang:latest as build
 ENV GOOS=windows
 ENV GOARCH=amd64
@@ -6,7 +10,7 @@ WORKDIR /app
 COPY ./delayed-shutdown.go ./
 RUN go build -o delayed-shutdown.exe
 
-FROM mcr.microsoft.com/windows/servercore:ltsc2022
+FROM mcr.microsoft.com/windows/servercore:ltsc2022@sha256:029d8eb737c978e3df0f26abb529efd38d3c9ecee9d8d0bba6d0c205f32dc263
 WORKDIR /app
 COPY --from=build /app/delayed-shutdown.exe .
 ENTRYPOINT ["delayed-shutdown.exe"]