diff --git a/docker/Dockerfile b/docker/Dockerfile
index 3a72a33c..eea588cb 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM rust:bookworm AS nono-builder
+FROM rust:bookworm@sha256:e9da6f6c3ed5095fd5d33bf7cdf309830a178a8147888f1b2f76d5769bd9306c AS nono-builder
 RUN apt-get update && apt-get install -y libdbus-1-dev pkg-config git ca-certificates
 # The nono pin lives in .nono-version at the repo root (single source of truth;
 # cli#341 S1's CI gate reads the same file). Clone the canonical repo, check out