diff --git a/Dockerfile b/Dockerfile
index 1e1bb97603..b3e1420c57 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,10 @@
 # the officially-released binary from releases.hashicorp.com and are
 # built by the (closed-source) official release process.
 
-FROM docker.mirror.hashicorp.services/golang:alpine
+# Pinned tag using SHA
+# sha256:c2335038e2230960f81cb2f9f1fc5eca45e23b765de1848c7bbfaebcfd32d90d
+# https://github.com/google/go-containerregistry/blob/main/cmid/crane/README.md
+FROM docker.mirror.hashicorp.services/golang@sha256:c2335038e2230960f81cb2f9f1fc5eca45e23b765de1848c7bbfaebcfd32d90d
 LABEL maintainer="HashiCorp Terraform Team <terraform@hashicorp.com>"
 
 RUN apk add --no-cache git bash openssh