diff --git a/release.Dockerfile b/release.Dockerfile
index e95d77a..a6c46c2 100644
--- a/release.Dockerfile
+++ b/release.Dockerfile
@@ -1,4 +1,7 @@
-FROM --platform=$BUILDPLATFORM alpine AS ruby-community-build
+# Pin the base image to an immutable digest (alpine 3.24.1) so the build cannot
+# silently pull a newer, potentially vulnerable `alpine:latest`. This stage is
+# only used to assemble files into the final scratch image; no OS packages ship.
+FROM --platform=$BUILDPLATFORM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS ruby-community-build
 WORKDIR /opentelemetry-ruby
 ARG TARGETARCH
 ARG RUBY_VERSIONS="3.1 3.2 3.3 3.4"