diff --git a/Dockerfile b/Dockerfile
index 728685f..4bd5567 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,17 +1,19 @@
-FROM ghcr.io/nodejs/wasm-builder:v0.0.10
+FROM ghcr.io/nodejs/wasm-builder@sha256:542fdbef9fa6eb003cc1eb89a9f3e6b967359471fdb29db4910c54474e70911d
 
 USER root
 
 ARG BINARYEN_VERSION=123
 ARG RUST_TOOLCHAIN=nightly-2026-07-29
+ARG CARGO_MAKE_VERSION=0.37.24
 
 RUN set -eux; \
     case "$(uname -m)" in \
-      x86_64) binaryen_arch=x86_64 ;; \
-      aarch64) binaryen_arch=aarch64 ;; \
+      x86_64) binaryen_arch=x86_64; binaryen_sha256=e959f2170af4c20c552e9de3a0253704d6a9d2766e8fdb88e4d6ac4bae9388fe ;; \
+      aarch64) binaryen_arch=aarch64; binaryen_sha256=4b6bd61ba6cd3b18c993b4657d93426c782f9b91b74be0d38018cd8be1319376 ;; \
       *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
     esac; \
     wget -q "https://github.com/WebAssembly/binaryen/releases/download/version_${BINARYEN_VERSION}/binaryen-version_${BINARYEN_VERSION}-${binaryen_arch}-linux.tar.gz" -O /tmp/binaryen.tar.gz; \
+    echo "${binaryen_sha256}  /tmp/binaryen.tar.gz" | sha256sum -c -; \
     tar -xzf /tmp/binaryen.tar.gz -C /tmp; \
     install -m 0755 "/tmp/binaryen-version_${BINARYEN_VERSION}/bin/wasm-opt" /usr/local/bin/wasm-opt; \
     rm -rf /tmp/binaryen.tar.gz "/tmp/binaryen-version_${BINARYEN_VERSION}"
@@ -22,10 +24,10 @@ RUN set -eux; \
     rustup toolchain install "${RUST_TOOLCHAIN}" --profile minimal; \
     rustup target add wasm32-unknown-unknown --toolchain "${RUST_TOOLCHAIN}"; \
     rustup component add rust-src --toolchain "${RUST_TOOLCHAIN}"; \
-    cargo +"${RUST_TOOLCHAIN}" install cargo-make --locked
+    cargo +"${RUST_TOOLCHAIN}" install cargo-make --version "${CARGO_MAKE_VERSION}" --locked
 
 ENV PATH="/home/node/.cargo/bin:${PATH}"
-ENV RUSTUP_TOOLCHAIN=nightly-2026-07-29
+ENV RUSTUP_TOOLCHAIN=${RUST_TOOLCHAIN}
 
 WORKDIR /workspace/parser
 
diff --git a/parser/Makefile.toml b/parser/Makefile.toml
index ba10689..f12cfab 100644
--- a/parser/Makefile.toml
+++ b/parser/Makefile.toml
@@ -37,7 +37,7 @@
   script = [
     "mkdir -p ../dist/cpp/${CONFIGURATION}",
     "rm -rf ../dist/cpp/${CONFIGURATION}/*",
-    "cargo build -Z unstable-options --target ${TARGET} ${CARGO_OPTIONS} --artifact-dir target/cpp/${CONFIGURATION}",
+    "cargo build --locked -Z unstable-options --target ${TARGET} ${CARGO_OPTIONS} --artifact-dir target/cpp/${CONFIGURATION}",
     "cp target/cpp/${CONFIGURATION}/libmilo_parser.a ../dist/cpp/${CONFIGURATION}/libmilo.a",
     "cp target/headers/milo.h ../dist/cpp/${CONFIGURATION}",
     "../scripts/target/release/postbuild-cpp ${CONFIGURATION}",
@@ -45,7 +45,7 @@
 
 [tasks."scripts:build"]
   command = "cargo"
-  args = ["build", "--release", "--manifest-path", "../scripts/Cargo.toml", "--target-dir", "../scripts/target", "--bins"]
+  args = ["build", "--locked", "--release", "--manifest-path", "../scripts/Cargo.toml", "--target-dir", "../scripts/target", "--bins"]
 
 [tasks."cpp:headers"]
   command = "cbindgen"
@@ -65,10 +65,10 @@
     "mkdir -p ../dist/wasm",
     "rm -rf ../dist/wasm/${CONFIGURATION}",
     "mkdir -p ../dist/wasm/${CONFIGURATION}/binary",
-    "RUSTFLAGS=\"${RUSTFLAGS_BASE} -C target-feature=+simd128\" cargo build --lib ${CARGO_BUILD_OPTIONS} --target wasm32-unknown-unknown ${CARGO_OPTIONS}",
+    "RUSTFLAGS=\"${RUSTFLAGS_BASE} -C target-feature=+simd128\" cargo build --locked --lib ${CARGO_BUILD_OPTIONS} --target wasm32-unknown-unknown ${CARGO_OPTIONS}",
     "cp -a target/wasm32-unknown-unknown/release/milo_parser.wasm ../dist/wasm/${CONFIGURATION}/binary/simd.wasm",
     "wasm-opt -O3 --enable-bulk-memory-opt --enable-simd -o ../dist/wasm/${CONFIGURATION}/binary/simd.wasm ../dist/wasm/${CONFIGURATION}/binary/simd.wasm",
-    "RUSTFLAGS=\"${RUSTFLAGS_BASE}\" cargo build --lib ${CARGO_BUILD_OPTIONS} --target wasm32-unknown-unknown ${CARGO_OPTIONS}",
+    "RUSTFLAGS=\"${RUSTFLAGS_BASE}\" cargo build --locked --lib ${CARGO_BUILD_OPTIONS} --target wasm32-unknown-unknown ${CARGO_OPTIONS}",
     "cp -a target/wasm32-unknown-unknown/release/milo_parser.wasm ../dist/wasm/${CONFIGURATION}/binary/no-simd.wasm",
     "wasm-opt -O3 --enable-bulk-memory-opt -o ../dist/wasm/${CONFIGURATION}/binary/no-simd.wasm ../dist/wasm/${CONFIGURATION}/binary/no-simd.wasm",
     "../scripts/target/release/postbuild-wasm ${CONFIGURATION}",