diff --git a/Dockerfile b/Dockerfile
index 3110e05..fb10545 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.23 AS builder
+FROM golang:1.23.3-alpine3.20@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -25,7 +25,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o ma
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:6cd937e9155bdfd805d1b94e037f9d6a899603306030936a3b11680af0c2ed58
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532
diff --git a/renovate.json b/renovate.json
index 55b1d1a..ec673c4 100644
--- a/renovate.json
+++ b/renovate.json
@@ -7,7 +7,6 @@
     "schedule:daily",
     "group:all"
   ],
-  "allowedPostUpgradeCommands": ["^make (tidy|generate)$"],
   "configMigration": true,
   "constraints": {
     "go": "1.23"
@@ -80,19 +79,6 @@
     "gomodTidy",
     "gomodUpdateImportPaths"
   ],
-  "postUpgradeTasks": {
-    "commands": [
-      "make tidy",
-      "make generate"
-    ],
-    "fileFilters": [
-      "**/go.mod",
-      "**/go.sum",
-      "**/*.go",
-      "**/*.yaml"
-    ],
-    "executionMode": "branch"
-  },
   "printConfig": false,
   "rebaseWhen": "behind-base-branch",
   "semanticCommits": "enabled",