diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml
index f46c832..00bcf16 100644
--- a/.github/workflows/cred-scan.yml
+++ b/.github/workflows/cred-scan.yml
@@ -13,6 +13,6 @@ jobs:
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     - name: Scan credentials
-      uses: outscale/cred-scan@main
+      uses: outscale/cred-scan@36ef82cc690d72a17bf0993ab323961f1b1f9c66 # main
       with:
         scan_path: "./"
diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml
index 6db5bdc..4302e5f 100644
--- a/.github/workflows/github-sanity-scan.yml
+++ b/.github/workflows/github-sanity-scan.yml
@@ -14,6 +14,6 @@ jobs:
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     - name: Github sanity scanner
-      uses: outscale/github-sanity-scan@main
+      uses: outscale/github-sanity-scan@380a9927b4be45d9c4f6f66a4e8dfd7cf7b18513 # main
       with:
         no-pull-request-target: true
diff --git a/helm/docker-compose.yaml b/helm/docker-compose.yaml
index d35f021..4743dea 100644
--- a/helm/docker-compose.yaml
+++ b/helm/docker-compose.yaml
@@ -9,7 +9,7 @@ services:
     ports:
       - 9090:9090
   osc-cost:
-    image: outscale/osc-cost:v0.8.0
+    image: outscale/osc-cost:v0.8.0@sha256:611690879da952d1316cfe80f3fd9e255fb6ca2f11d32617ef2a26519467f350
     networks:
       - localprom
     ports: