diff --git a/src/codeprobe/sandbox/Dockerfile.sg_only b/src/codeprobe/sandbox/Dockerfile.sg_only
index 82e26098..4ca9b85d 100644
--- a/src/codeprobe/sandbox/Dockerfile.sg_only
+++ b/src/codeprobe/sandbox/Dockerfile.sg_only
@@ -3,7 +3,7 @@
 # Provides python + git + ripgrep + coreutils so agents can run read/search/
 # script workloads inside a container whose only writable surfaces are
 # those explicitly bind-mounted :rw by the caller.
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1
 
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONDONTWRITEBYTECODE=1 \