diff --git a/.gitea/workflows/pr-docker-deploy.yml b/.gitea/workflows/pr-docker-deploy.yml
index 107f5b2..88b4783 100644
--- a/.gitea/workflows/pr-docker-deploy.yml
+++ b/.gitea/workflows/pr-docker-deploy.yml
@@ -183,7 +183,7 @@ jobs:
           HC_VAULT_SECRETS_PATH: benedikta-docker/env
 
       - name: Docker Compose Dry Run
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
         with:
           mode: compose
           file: ${{ steps.compose_file_list.outputs.compose_list }}
@@ -304,7 +304,7 @@ jobs:
           HC_VAULT_SECRETS_PATH: benedikta-docker/env
 
       - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
         with:
           mode: compose
           file: ${{ needs.docker-compose-dry-run.outputs.compose_file_list }}
diff --git a/.gitea/workflows/renovate-pr-deploy.yml b/.gitea/workflows/renovate-pr-deploy.yml
index b414766..5da3421 100644
--- a/.gitea/workflows/renovate-pr-deploy.yml
+++ b/.gitea/workflows/renovate-pr-deploy.yml
@@ -112,7 +112,7 @@ jobs:
           HC_VAULT_SECRETS_PATH: benedikta-docker/env
 
       - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
         with:
           mode: compose
           file: ${{ steps.compose_file_list.outputs.compose_list }}
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index a7f98f1..7cbfc5c 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  RENOVATE_VERSION: "42.26.11"
+  RENOVATE_VERSION: "42.50.3"
 
 jobs:
   renovate:
diff --git a/docker-compose.yml b/docker-compose.yml
index 69db928..6f16449 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -73,14 +73,14 @@ services:
     container_name: wyoming-satellite
     devices:
       - /dev/snd
-    image: sker65/wyoming-satellite
+    image: sker65/wyoming-satellite@sha256:581e592794db847aee730e7c8cbf23217e9f779724f9f8b004072ddc4f3a701d
     ports:
       - 10700:10700
     restart: unless-stopped
   wyoming-openwakeword:
     command: "--preload-model ok_nabu --debug"
     container_name: wyoming-openwakeword
-    image: rhasspy/wyoming-openwakeword
+    image: rhasspy/wyoming-openwakeword@sha256:52cb1168731a1849fc28cf339c935fde58746bbabc94226668a40ef6ddf5d42b
     ports:
       - 10400:10400
     restart: unless-stopped