diff --git a/servers/bwh-hk-cmi/litellm/compose.yaml b/servers/bwh-hk-cmi/litellm/compose.yaml
index 454d4e3..2837f75 100644
--- a/servers/bwh-hk-cmi/litellm/compose.yaml
+++ b/servers/bwh-hk-cmi/litellm/compose.yaml
@@ -1,6 +1,6 @@
 services:
   adc-init:
-    image: alpine:3.24
+    image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
     restart: "no"
     environment:
       GOOGLE_ADC_B64: ${GOOGLE_ADC_B64}
@@ -14,7 +14,7 @@ services:
         printf '%s' "$${GOOGLE_ADC_B64}" | base64 -d > /credentials/application_default_credentials.json
 
   litellm:
-    image: ghcr.io/berriai/litellm:main-stable
+    image: ghcr.io/berriai/litellm:main-stable@sha256:625981c83410a3ea68eb0697590a57ec1d764d634514d54fa5db0591077ee839
     restart: unless-stopped
     depends_on:
       adc-init:
diff --git a/servers/bwh-hk-cmi/sing-box/compose.yaml b/servers/bwh-hk-cmi/sing-box/compose.yaml
index 2932e9f..e8c0ad8 100644
--- a/servers/bwh-hk-cmi/sing-box/compose.yaml
+++ b/servers/bwh-hk-cmi/sing-box/compose.yaml
@@ -1,6 +1,6 @@
 services:
   config-render:
-    image: alpine:3.24
+    image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
     environment:
       DOMAIN: ${DOMAIN}
       ANYTLS_DOMAIN: ${ANYTLS_DOMAIN}
@@ -30,7 +30,7 @@ services:
     restart: "no"
 
   sing-box:
-    image: ghcr.io/sagernet/sing-box:v1.14.0
+    image: ghcr.io/sagernet/sing-box:v1.14.1@sha256:38d9eff063f035236ddd0d0c752fd8491895dfd9ed4f6da808778716522c8835
     restart: unless-stopped
     depends_on:
       config-render:
diff --git a/servers/bwh-hk-cmi/web/compose.yaml b/servers/bwh-hk-cmi/web/compose.yaml
index 9f36a8a..07f49ee 100644
--- a/servers/bwh-hk-cmi/web/compose.yaml
+++ b/servers/bwh-hk-cmi/web/compose.yaml
@@ -1,6 +1,6 @@
 services:
   haproxy:
-    image: haproxy:3.4.4-alpine3.24
+    image: haproxy:3.4.6-alpine3.24@sha256:7af8255207ee9964ccb4eec8ce4b7a40b777769665e3ae83897fb01b24d8a43a
     container_name: haproxy
     restart: unless-stopped
     ports:
@@ -18,7 +18,7 @@ services:
         max-file: "2"
 
   caddy:
-    image: caddy:2.11.4
+    image: caddy:2.11.6@sha256:3422ce6de165df66534f9b9ba50efaf457114ec961763cc52f5dbdaac2972d73
     container_name: caddy
     restart: unless-stopped
     ports:
@@ -33,7 +33,7 @@ services:
       - hk-web
 
   filebrowser:
-    image: filebrowser/filebrowser:s6
+    image: filebrowser/filebrowser:s6@sha256:ee4ac79e52966a5f6247f99c7d667c1debfb277a3a61ab829f505aa8f4c74b21
     container_name: filebrowser
     restart: unless-stopped
     environment:
@@ -45,7 +45,7 @@ services:
       - /opt/stacks/web/filebrowser/storage:/srv/web
 
   webdav:
-    image: jinlife/docker-cwebdav
+    image: jinlife/docker-cwebdav:latest@sha256:adffa1f20dc4a500f1f54c8b02e3c85c767474a3d62f3106782fccdb52443c1b
     restart: always
     environment:
       USERNAME: dav