diff --git a/buildkite/terraform/bazel/pipeline.yml.tpl b/buildkite/terraform/bazel/pipeline.yml.tpl
index 932e86ebcc..e8f8e9908b 100644
--- a/buildkite/terraform/bazel/pipeline.yml.tpl
+++ b/buildkite/terraform/bazel/pipeline.yml.tpl
@@ -26,7 +26,7 @@ steps:
             - "ANDROID_HOME"
             - "ANDROID_NDK_HOME"
             - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
-          image: "${try(steps.image, "gcr.io/bazel-public/ubuntu2404")}"
+          image: "${try(steps.image, "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c")}"
           network: "host"
           privileged: true
           propagate-environment: true
diff --git a/buildkite/terraform/bazel/pipelines_bazel.tf b/buildkite/terraform/bazel/pipelines_bazel.tf
index cd686c34ac..0f447583b1 100644
--- a/buildkite/terraform/bazel/pipelines_bazel.tf
+++ b/buildkite/terraform/bazel/pipelines_bazel.tf
@@ -891,7 +891,7 @@ resource "buildkite_pipeline" "bcr-bazel-compatibility-test" {
       # SKIP_WAIT_FOR_APPROVAL: 1
     },
     steps = {
-      image = "gcr.io/bazel-public/ubuntu2404",
+      image = "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c",
       commands = [
         "curl -sS \"https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)\" -o bazelci.py",
         "curl -sS \"https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazel-central-registry/bcr_presubmit.py?$(date +%s)\" -o bcr_presubmit.py",