diff --git a/jenkins/jobbuilder.groovy b/jenkins/jobbuilder.groovy
index c585e73..f05f481 100644
--- a/jenkins/jobbuilder.groovy
+++ b/jenkins/jobbuilder.groovy
@@ -44,10 +44,12 @@ pipeline {
             steps {
                 withCredentials([usernamePassword(credentialsId: 'JENKINS_BOT_CREDENTIALS', passwordVariable: 'JENKINS_BOT_PASSWORD', usernameVariable: 'JENKINS_BOT_USERNAME')]) {
                     sh '''
+                        JENKINS_USERNAME="$JENKINS_BOT_USERNAME" \
+                        JENKINS_PASSWORD="$JENKINS_BOT_PASSWORD" \
                         docker run --rm \
                             --env JENKINS_URL=https://testing.stackable.tech \
-                            --env JENKINS_USERNAME=$JENKINS_BOT_USERNAME \
-                            --env JENKINS_PASSWORD=$JENKINS_BOT_PASSWORD \
+                            --env JENKINS_USERNAME \
+                            --env JENKINS_PASSWORD \
                             oci.stackable.tech/jenkins-job-builder:latest
                     '''
                 }
diff --git a/tools/harbor-garbage-collector/Dockerfile b/tools/harbor-garbage-collector/Dockerfile
index 8383a72..b701542 100644
--- a/tools/harbor-garbage-collector/Dockerfile
+++ b/tools/harbor-garbage-collector/Dockerfile
@@ -1,6 +1,6 @@
 FROM oci.stackable.tech/sdp/ubi8-rust-builder AS builder
 
-FROM registry.access.redhat.com/ubi8/ubi-minimal AS operator
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.10@sha256:578b238953144445a9b5bb2487eb1d95df4886f98d1f73c4a070b27535f51688 AS operator
 
 ARG VERSION
 ARG RELEASE="1"
diff --git a/tools/harbor-sbom-browser/Dockerfile b/tools/harbor-sbom-browser/Dockerfile
index c1bfd93..2776463 100644
--- a/tools/harbor-sbom-browser/Dockerfile
+++ b/tools/harbor-sbom-browser/Dockerfile
@@ -9,6 +9,8 @@ ARG RELEASE="1"
 RUN microdnf install -y yum \
     && yum -y update-minimal --security --sec-severity=Important --sec-severity=Critical \
     && curl -L -O https://github.com/sigstore/cosign/releases/download/v3.0.2/cosign-3.0.2-1.x86_64.rpm \
+    && echo "7b6ae0f1e8da49d196f89245d4014887747c01c215e2e7f41e4853c98a28ed9b  cosign-3.0.2-1.x86_64.rpm" > cosign-3.0.2-1.x86_64.rpm.sha256 \
+    && sha256sum -c cosign-3.0.2-1.x86_64.rpm.sha256 \
     && rpm -ivh cosign-3.0.2-1.x86_64.rpm \
     && yum clean all \
     && microdnf clean all
diff --git a/tools/monitor-oci-artifacts/Dockerfile b/tools/monitor-oci-artifacts/Dockerfile
index a3916b7..e3728ce 100644
--- a/tools/monitor-oci-artifacts/Dockerfile
+++ b/tools/monitor-oci-artifacts/Dockerfile
@@ -1,6 +1,6 @@
 FROM oci.stackable.tech/sdp/ubi9-rust-builder AS builder
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal AS operator
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:7c5495d5fad59aaee12abc3cbbd2b283818ee1e814b00dbc7f25bf2d14fa4f0c AS operator
 
 ARG VERSION
 ARG RELEASE="1"
@@ -9,6 +9,8 @@ ARG RELEASE="1"
 RUN microdnf install -y yum \
     && yum -y update-minimal --security --sec-severity=Important --sec-severity=Critical \
     && curl -L -O https://github.com/sigstore/cosign/releases/download/v3.0.2/cosign-3.0.2-1.x86_64.rpm \
+    && echo "7b6ae0f1e8da49d196f89245d4014887747c01c215e2e7f41e4853c98a28ed9b  cosign-3.0.2-1.x86_64.rpm" > cosign-3.0.2-1.x86_64.rpm.sha256 \
+    && sha256sum -c cosign-3.0.2-1.x86_64.rpm.sha256 \
     && rpm -ivh cosign-3.0.2-1.x86_64.rpm \
     && yum clean all \
     && microdnf clean all
diff --git a/tools/nexus-garbage-collector/Dockerfile b/tools/nexus-garbage-collector/Dockerfile
index 9890e92..e427ae3 100644
--- a/tools/nexus-garbage-collector/Dockerfile
+++ b/tools/nexus-garbage-collector/Dockerfile
@@ -1,6 +1,6 @@
 FROM oci.stackable.tech/sdp/ubi8-rust-builder AS builder
 
-FROM registry.access.redhat.com/ubi8/ubi-minimal AS operator
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.10@sha256:578b238953144445a9b5bb2487eb1d95df4886f98d1f73c4a070b27535f51688 AS operator
 
 ARG VERSION
 ARG RELEASE="1"