diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 685a68d..c51246d 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -34,10 +34,10 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4.2.1
+        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/terraform-ci-role
@@ -113,7 +113,7 @@ jobs:
           echo "Secrets loaded successfully"
       
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
           terraform_version: ${{ env.TF_VERSION }}
       
@@ -136,7 +136,7 @@ jobs:
         continue-on-error: true
       
       - name: Comment PR with Plan
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         if: github.event_name == 'pull_request'
         env:
           PLAN: "${{ steps.plan.outputs.stdout }}"
@@ -184,10 +184,10 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4.2.1
+        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/terraform-ci-role
@@ -263,7 +263,7 @@ jobs:
           echo "Secrets loaded successfully"
       
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
           terraform_version: ${{ env.TF_VERSION }}
       
diff --git a/reverse_proxy/docker-compose.yml b/reverse_proxy/docker-compose.yml
index b65f7cf..23bed97 100644
--- a/reverse_proxy/docker-compose.yml
+++ b/reverse_proxy/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   reverse-proxy-certonly:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606
     container_name: reverse_proxy_for_certbot
     configs:
       - source: nginx_certonly_conf
@@ -15,7 +15,7 @@ services:
       - app-network
 
   certbot:
-    image: certbot/certbot
+    image: certbot/certbot@sha256:bc93cb710b413e6b456d622f9b0133b3e109c0a78c2ed9976af43d209b0a1805
     container_name: certbot
     depends_on:
       reverse-proxy-certonly:
@@ -43,7 +43,7 @@ services:
       -d immo.jakob-lingel.dev
 
   reverse-proxy:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606
     container_name: reverse_proxy
     depends_on: 
       certbot:
@@ -63,7 +63,7 @@ services:
     restart: unless-stopped
 
   certbot-renewal-manager: 
-    image: certbot/certbot
+    image: certbot/certbot@sha256:bc93cb710b413e6b456d622f9b0133b3e109c0a78c2ed9976af43d209b0a1805
     container_name: certbot_renewal_manager
     volumes:
       - certbot-etc:/etc/letsencrypt
diff --git a/saas/resend/package.json b/saas/resend/package.json
index 3b17a6a..6248c29 100644
--- a/saas/resend/package.json
+++ b/saas/resend/package.json
@@ -14,7 +14,7 @@
     "resend": "^4.0.0"
   },
   "devDependencies": {
-    "tsx": "^4.7.0",
-    "typescript": "^5.3.0"
+    "tsx": "4.23.15",
+    "typescript": "5.9.3"
   }
 }