diff --git a/docker/Dockerfile b/docker/Dockerfile
index 147f6213..b0e6e912 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,26 +1,26 @@
 # syntax=docker/dockerfile:1.4
-FROM ubuntu:lunar as base
+FROM ubuntu:lunar-20231004@sha256:51e70689b125fcc2e800f5efb7ba465dee85ede9da9c268ff5599053c7e52b77 as base
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN --mount=type=cache,target=/var/cache/apt --mount=type=tmpfs,target=/var/lib/apt/lists \
     apt-get update && apt-get install -y --no-install-recommends \
-    python3.11=3.11.2-6ubuntu0.1 \
+    python3.11=3.11.4-1~23.04 \
     # renovate: srcname=python3.11
-    libpython3.11=3.11.2-6ubuntu0.1 \
+    libpython3.11=3.11.4-1~23.04 \
     # renovate: srcname=python3.11
-    python3.11-venv=3.11.2-6ubuntu0.1 \
+    python3.11-venv=3.11.4-1~23.04 \
     # renovate: srcname=python-pip
-    python3-pip=23.0.1+dfsg-1 \
+    python3-pip=23.0.1+dfsg-1ubuntu0.1 \
     # renovate: srcname=postgresql-15
-    libpq5=15.3-0ubuntu0.23.04.1 \
+    libpq5=15.4-0ubuntu0.23.04.1 \
     # renovate: srcname=postgresql-15
-    postgresql-client-15=15.3-0ubuntu0.23.04.1 \
-    curl=7.88.1-8ubuntu2 \
+    postgresql-client-15=15.4-0ubuntu0.23.04.1 \
+    curl=7.88.1-8ubuntu2.3 \
     libpcre3=2:8.39-15 \
     # renovate: srcname=librsvg
-    librsvg2-2=2.54.5+dfsg-1ubuntu2 \
+    librsvg2-2=2.54.5+dfsg-1ubuntu2.1 \
     # renovate: srcname=librsvg
-    gir1.2-rsvg-2.0=2.54.5+dfsg-1ubuntu2 \
+    gir1.2-rsvg-2.0=2.54.5+dfsg-1ubuntu2.1 \
     libgirepository-1.0-1=1.76.1-1 \
     tzdata=2023c-2exp1ubuntu1.1 \
     ca-certificates=20230311ubuntu0.23.04.1
@@ -32,10 +32,10 @@ RUN --mount=type=cache,target=/var/cache/apt --mount=type=tmpfs,target=/var/lib/
     apt-get update && apt-get install -y --no-install-recommends \
     build-essential=12.9ubuntu3 \
     # renovate: srcname=python3.11
-    python3.11-dev=3.11.2-6ubuntu0.1 \
+    python3.11-dev=3.11.4-1~23.04 \
     libpcre3-dev=2:8.39-15 \
     # renovate: srcname=postgresql-15
-    libpq-dev=15.3-0ubuntu0.23.04.1 \
+    libpq-dev=15.4-0ubuntu0.23.04.1 \
     libgirepository1.0-dev=1.76.1-1