diff --git a/Dockerfile b/Dockerfile
index 1ff77ae9ad8f..5e371363e0ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG RUNC_VERSION=v1.1.14
 ARG CONTAINERD_VERSION=v1.7.21
diff --git a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
index bcdcb21d0181..0f68860c85fb 100644
--- a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
+++ b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG GO_VERSION=1.22
 ARG ALPINE_VERSION=3.20
diff --git a/hack/dockerfiles/archutil.Dockerfile b/hack/dockerfiles/archutil.Dockerfile
index 878afb183b9f..938ae5144fa8 100644
--- a/hack/dockerfiles/archutil.Dockerfile
+++ b/hack/dockerfiles/archutil.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 # check=error=true
 
 ARG GO_VERSION=1.22
diff --git a/hack/dockerfiles/authors.Dockerfile b/hack/dockerfiles/authors.Dockerfile
index 86ec5d18a037..af14d0bddeca 100644
--- a/hack/dockerfiles/authors.Dockerfile
+++ b/hack/dockerfiles/authors.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG ALPINE_VERSION=3.20
 
diff --git a/hack/dockerfiles/doctoc.Dockerfile b/hack/dockerfiles/doctoc.Dockerfile
index 474017e6f372..88b1a6766693 100644
--- a/hack/dockerfiles/doctoc.Dockerfile
+++ b/hack/dockerfiles/doctoc.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG NODE_VERSION=19
 
diff --git a/hack/dockerfiles/generated-files.Dockerfile b/hack/dockerfiles/generated-files.Dockerfile
index a73fdf95b642..a9b670e84ee6 100644
--- a/hack/dockerfiles/generated-files.Dockerfile
+++ b/hack/dockerfiles/generated-files.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG GO_VERSION=1.22
 ARG DEBIAN_VERSION=bookworm
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index ae8734adbbe2..bc23e9dfd63d 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG GO_VERSION=1.22
 ARG ALPINE_VERSION=3.20
diff --git a/hack/dockerfiles/shfmt.Dockerfile b/hack/dockerfiles/shfmt.Dockerfile
index 86b3e86847a6..3243b2652443 100644
--- a/hack/dockerfiles/shfmt.Dockerfile
+++ b/hack/dockerfiles/shfmt.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 FROM mvdan/shfmt:v3.1.2-alpine AS shfmt
 WORKDIR /src
diff --git a/hack/dockerfiles/vendor.Dockerfile b/hack/dockerfiles/vendor.Dockerfile
index 859ccd2d16d9..91760388f262 100644
--- a/hack/dockerfiles/vendor.Dockerfile
+++ b/hack/dockerfiles/vendor.Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:master
+# syntax=docker/dockerfile-upstream:master@sha256:df54e73548d586209f6fc6d34d61edf8277e1b9d2704aff8fe75294a17c6a29b
 
 ARG GO_VERSION=1.22
 ARG ALPINE_VERSION=3.20