diff --git a/.github/workflows/build-and-push-reusable.yml b/.github/workflows/build-and-push-reusable.yml
index c094e4c..272f822 100644
--- a/.github/workflows/build-and-push-reusable.yml
+++ b/.github/workflows/build-and-push-reusable.yml
@@ -46,12 +46,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4.0.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -83,11 +83,11 @@ jobs:
           echo "ref=${IMAGE_REF}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.0.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v6.0.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ env.REGISTRY }}/${{ steps.namespace.outputs.owner }}/${{ inputs.image_name }}
           tags: |
@@ -96,7 +96,7 @@ jobs:
             type=raw,value=${{ steps.pkg.outputs.version }},enable=${{ steps.pkg.outputs.version != '' }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7.0.0
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
diff --git a/.github/workflows/build-backend.yml b/.github/workflows/build-backend.yml
index b297ee6..eb25ead 100644
--- a/.github/workflows/build-backend.yml
+++ b/.github/workflows/build-backend.yml
@@ -35,7 +35,7 @@ jobs:
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
@@ -67,7 +67,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -75,7 +75,7 @@ jobs:
           repositories: ${{ env.APP_REPO_NAME }},${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -124,7 +124,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -132,7 +132,7 @@ jobs:
           repositories: ${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout app-of-apps repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ env.GITHUB_OWNER }}/${{ env.APP_OF_APPS_REPO }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/build-frontend.yml b/.github/workflows/build-frontend.yml
index d474a85..d4a525f 100644
--- a/.github/workflows/build-frontend.yml
+++ b/.github/workflows/build-frontend.yml
@@ -35,7 +35,7 @@ jobs:
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
@@ -67,7 +67,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -75,7 +75,7 @@ jobs:
           repositories: ${{ env.APP_REPO_NAME }},${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -124,7 +124,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -132,7 +132,7 @@ jobs:
           repositories: ${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout app-of-apps repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ env.GITHUB_OWNER }}/${{ env.APP_OF_APPS_REPO }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/build-keycloak.yml b/.github/workflows/build-keycloak.yml
index 4c96f02..7d13c44 100644
--- a/.github/workflows/build-keycloak.yml
+++ b/.github/workflows/build-keycloak.yml
@@ -34,7 +34,7 @@ jobs:
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
@@ -66,7 +66,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -74,7 +74,7 @@ jobs:
           repositories: ${{ env.APP_REPO_NAME }},${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -120,7 +120,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -128,7 +128,7 @@ jobs:
           repositories: ${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout app-of-apps repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ env.GITHUB_OWNER }}/${{ env.APP_OF_APPS_REPO }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/be/dockerfile b/be/dockerfile
index f79c760..ab56f69 100644
--- a/be/dockerfile
+++ b/be/dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-bullseye AS base
+FROM node:22-bullseye@sha256:b65845e07a46fcae018a6c6eedbe247d00103a5ebee99dd71e73436bcc882660 AS base
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
   ghostscript \
diff --git a/be/package.json b/be/package.json
index cd73040..007d8f8 100644
--- a/be/package.json
+++ b/be/package.json
@@ -49,34 +49,34 @@
     "typeorm": "^0.3.20"
   },
   "devDependencies": {
-    "@nestjs/cli": "^10.0.0",
-    "@nestjs/schematics": "^10.0.0",
-    "@nestjs/testing": "^10.0.0",
-    "@swc/cli": "^0.5.2",
-    "@swc/core": "^1.4.4",
-    "@types/cookie-parser": "^1.4.7",
-    "@types/express": "^4.17.17",
-    "@types/express-session": "^1.18.0",
-    "@types/jest": "^29.5.2",
-    "@types/multer": "^1.4.11",
-    "@types/node": "^20.3.1",
-    "@types/passport-jwt": "^4.0.1",
-    "@types/passport-local": "^1.0.38",
-    "@types/supertest": "^6.0.0",
-    "@typescript-eslint/eslint-plugin": "^6.0.0",
-    "@typescript-eslint/parser": "^6.0.0",
-    "eslint": "^8.42.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-prettier": "^5.0.0",
-    "jest": "^29.5.0",
-    "prettier": "^3.0.0",
-    "source-map-support": "^0.5.21",
-    "supertest": "^6.3.3",
-    "ts-jest": "^29.1.0",
-    "ts-loader": "^9.4.3",
-    "ts-node": "^10.9.1",
-    "tsconfig-paths": "^4.2.0",
-    "typescript": "^5.1.3"
+    "@nestjs/cli": "10.4.9",
+    "@nestjs/schematics": "10.2.3",
+    "@nestjs/testing": "10.4.22",
+    "@swc/cli": "0.5.2",
+    "@swc/core": "1.15.43",
+    "@types/cookie-parser": "1.4.10",
+    "@types/express": "4.17.25",
+    "@types/express-session": "1.19.0",
+    "@types/jest": "29.5.14",
+    "@types/multer": "1.4.13",
+    "@types/node": "20.19.43",
+    "@types/passport-jwt": "4.0.1",
+    "@types/passport-local": "1.0.38",
+    "@types/supertest": "6.0.3",
+    "@typescript-eslint/eslint-plugin": "6.21.0",
+    "@typescript-eslint/parser": "6.21.0",
+    "eslint": "8.57.1",
+    "eslint-config-prettier": "9.1.2",
+    "eslint-plugin-prettier": "5.5.6",
+    "jest": "29.7.0",
+    "prettier": "3.9.4",
+    "source-map-support": "0.5.21",
+    "supertest": "6.3.4",
+    "ts-jest": "29.4.11",
+    "ts-loader": "9.6.2",
+    "ts-node": "10.9.2",
+    "tsconfig-paths": "4.2.0",
+    "typescript": "5.9.3"
   },
   "jest": {
     "moduleFileExtensions": [
diff --git a/deploy/docker-compose.development.yml b/deploy/docker-compose.development.yml
index f75cb14..2dc5706 100644
--- a/deploy/docker-compose.development.yml
+++ b/deploy/docker-compose.development.yml
@@ -33,7 +33,7 @@ services:
       - app-network
 
   certbot:
-    image: certbot/certbot
+    image: certbot/certbot@sha256:0107d084c225631fc64a8313e19adb07275f7296fde338f7dfa93986c80b2e3e
     container_name: certbot
     volumes:
       - certbot-etc:/etc/letsencrypt
diff --git a/deploy/docker-compose.local.yml b/deploy/docker-compose.local.yml
index e6f750b..1897fed 100644
--- a/deploy/docker-compose.local.yml
+++ b/deploy/docker-compose.local.yml
@@ -46,7 +46,7 @@ services:
       - "--hostname=localhost"
 
   keycloak_db:
-    image: postgres
+    image: postgres@sha256:4aabea78cf39b90e834caf3af7d602a18565f6fe2508705c8d01aa63245c2e20
     container_name: keycloak_db
     restart: always
     # set shared memory limit when using docker-compose
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 58b5889..44ff458 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -28,7 +28,7 @@ services:
       - app-network
 
   keycloak_db:
-    image: postgres
+    image: postgres@sha256:4aabea78cf39b90e834caf3af7d602a18565f6fe2508705c8d01aa63245c2e20
     container_name: keycloak_db
     restart: always
     # set shared memory limit when using docker-compose
diff --git a/deploy/reverse-proxy/docker-compose.yml b/deploy/reverse-proxy/docker-compose.yml
index 1e95749..19ef24d 100644
--- a/deploy/reverse-proxy/docker-compose.yml
+++ b/deploy/reverse-proxy/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   reverse-proxy:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:54f2a904c251d5a34adf545a72d32515a15e08418dae0266e23be2e18c66fefa
     container_name: reverse_proxy
     configs:
       - source: nginx_conf
@@ -17,7 +17,7 @@ services:
       - app-network
 
   certbot:
-    image: certbot/certbot
+    image: certbot/certbot@sha256:0107d084c225631fc64a8313e19adb07275f7296fde338f7dfa93986c80b2e3e
     container_name: certbot
     volumes:
       - certbot-etc:/etc/letsencrypt
diff --git a/fe/bun.lockb b/fe/bun.lockb
index 0164a56..5f5ae9b 100755
Binary files a/fe/bun.lockb and b/fe/bun.lockb differ
diff --git a/fe/dockerfile b/fe/dockerfile
index 1d224ea..18a4b26 100644
--- a/fe/dockerfile
+++ b/fe/dockerfile
@@ -1,4 +1,4 @@
-FROM node:20-alpine AS base
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS base
 
 WORKDIR /app
 
@@ -13,7 +13,7 @@ COPY . .
 FROM base AS build
 RUN npm run build
 
-FROM nginx:latest
+FROM nginx:latest@sha256:ec4ed8b5299e5e90694af7750eb6dffd2627317d30544d056b0371f8082f7bce
 COPY --from=build /app/dist /var/www/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 WORKDIR /var/www/html
diff --git a/fe/dockerfile.develop b/fe/dockerfile.develop
index 177b08f..4229241 100644
--- a/fe/dockerfile.develop
+++ b/fe/dockerfile.develop
@@ -1,4 +1,4 @@
-FROM node:20-alpine AS base
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS base
 
 WORKDIR /app
 
diff --git a/fe/package.json b/fe/package.json
index c1ab766..6e0ef25 100644
--- a/fe/package.json
+++ b/fe/package.json
@@ -35,15 +35,15 @@
   "devDependencies": {
     "@types/react": "^19.0.4",
     "@types/react-dom": "^19.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.19.1",
-    "@typescript-eslint/parser": "^8.19.1",
-    "@vitejs/plugin-react-swc": "^3.7.2",
-    "autoprefixer": "^10.4.20",
-    "eslint": "^9.18.0",
-    "eslint-plugin-react-hooks": "^5.1.0",
-    "eslint-plugin-react-refresh": "^0.4.16",
-    "prettier-plugin-tailwindcss": "^0.6.9",
-    "typescript": "^5.7.3",
-    "vite": "^6.0.7"
+    "@typescript-eslint/eslint-plugin": "8.62.1",
+    "@typescript-eslint/parser": "8.62.1",
+    "@vitejs/plugin-react-swc": "3.11.0",
+    "autoprefixer": "10.5.2",
+    "eslint": "9.39.4",
+    "eslint-plugin-react-hooks": "5.2.0",
+    "eslint-plugin-react-refresh": "0.4.26",
+    "prettier-plugin-tailwindcss": "0.6.14",
+    "typescript": "5.9.3",
+    "vite": "6.4.3"
   }
 }
diff --git a/keycloak/dockerfile b/keycloak/dockerfile
index 466080b..a526f0b 100644
--- a/keycloak/dockerfile
+++ b/keycloak/dockerfile
@@ -1,4 +1,4 @@
-FROM node:20-alpine AS theme-builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS theme-builder
 
 RUN apk update && apk add --no-cache openjdk17 maven
 
@@ -10,7 +10,7 @@ RUN npm ci
 COPY theme-app/ ./
 RUN npm run build-keycloak-theme
 
-FROM quay.io/keycloak/keycloak:latest AS builder
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4 AS builder
 
 # Enable health and metrics support
 ENV KC_HEALTH_ENABLED=true
@@ -20,7 +20,7 @@ WORKDIR /opt/keycloak
 COPY --from=theme-builder /app/theme-app/dist_keycloak/keycloak-theme-for-kc-all-other-versions.jar /opt/keycloak/providers/
 RUN /opt/keycloak/bin/kc.sh build
 
-FROM quay.io/keycloak/keycloak:latest
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 
 # Copy the startup script
diff --git a/keycloak/dockerfile.dev b/keycloak/dockerfile.dev
index 847a992..a261aa7 100644
--- a/keycloak/dockerfile.dev
+++ b/keycloak/dockerfile.dev
@@ -1,4 +1,4 @@
-FROM quay.io/keycloak/keycloak:latest AS builder
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4 AS builder
 
 # Enable health and metrics support
 ENV KC_HEALTH_ENABLED=true
@@ -9,7 +9,7 @@ WORKDIR /opt/keycloak
 RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:localhost,IP:127.0.0.1" -keystore conf/server.keystore
 RUN /opt/keycloak/bin/kc.sh build
 
-FROM quay.io/keycloak/keycloak:latest
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 
 ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
diff --git a/keycloak/theme-app/package-lock.json b/keycloak/theme-app/package-lock.json
index 3ea1378..bac4ed6 100644
--- a/keycloak/theme-app/package-lock.json
+++ b/keycloak/theme-app/package-lock.json
@@ -15,9 +15,9 @@
       "devDependencies": {
         "@types/react": "^18.2.43",
         "@types/react-dom": "^18.2.17",
-        "@vitejs/plugin-react": "^4.2.1",
-        "typescript": "^5.2.2",
-        "vite": "^5.0.8"
+        "@vitejs/plugin-react": "4.7.0",
+        "typescript": "5.9.3",
+        "vite": "5.4.21"
       },
       "engines": {
         "node": "^18.0.0 || >=20.0.0"
@@ -54,7 +54,6 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -1169,7 +1168,6 @@
       "integrity": "sha512-z9VXpC7MWrhfWipitjNdgCauoMLRdIILQsAEV+ZesIzBq/oUlxk0m3ApZuMFCXdnS4U7KrI+l3WRUEGQ8K1QKw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -1239,7 +1237,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.10.12",
         "caniuse-lite": "^1.0.30001782",
@@ -1528,7 +1525,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -1690,7 +1686,6 @@
       "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.21.3",
         "postcss": "^8.4.43",
diff --git a/keycloak/theme-app/package.json b/keycloak/theme-app/package.json
index 0fc3c4b..1927ed4 100644
--- a/keycloak/theme-app/package.json
+++ b/keycloak/theme-app/package.json
@@ -16,9 +16,9 @@
   "devDependencies": {
     "@types/react": "^18.2.43",
     "@types/react-dom": "^18.2.17",
-    "@vitejs/plugin-react": "^4.2.1",
-    "typescript": "^5.2.2",
-    "vite": "^5.0.8"
+    "@vitejs/plugin-react": "4.7.0",
+    "typescript": "5.9.3",
+    "vite": "5.4.21"
   },
   "engines": {
     "node": "^18.0.0 || >=20.0.0"