diff --git a/.github/workflows/report.yaml b/.github/workflows/report.yaml
index ce5782b56..08c5e0618 100644
--- a/.github/workflows/report.yaml
+++ b/.github/workflows/report.yaml
@@ -15,7 +15,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download from Artifacts
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@268677152d06ba59fcec7a7f0b5d961b6ccd7e1e # v2
         with:
           workflow: ${{ github.event.workflow.name }}
           run_id: ${{github.event.workflow_run.id }}
diff --git a/docs/requirements.txt b/docs/requirements.txt
index 4f76b0480..fe1b2b010 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,6 +1,6 @@
-docutils==0.16
+docutils==0.20.1
 sphinx>=4.3.0
 sphinx-copybutton
 sphinx-rtd-theme>=0.5.1
 sphinx-tabs
-urllib3==2.0.2
+urllib3==2.2.1
diff --git a/nix/Dockerfile b/nix/Dockerfile
index 99fefa87c..526ffe644 100644
--- a/nix/Dockerfile
+++ b/nix/Dockerfile
@@ -1,7 +1,7 @@
 # This Dockerfile is only used as a development environment for
 # non-nix systems, i.e. Windows.
 
-FROM nixos/nix:latest
+FROM nixos/nix:latest@sha256:273671b9032d06844ec073affa9fb1e75bf7ad863975bec5143e7fa417929fb8
 
 RUN apk --no-cache add \
     wget