diff --git a/.forgejo/workflows/lint.yaml b/.forgejo/workflows/lint.yaml
index 1002532..3c64472 100644
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@@ -24,7 +24,7 @@ jobs:
       # work in our environmnet.
       # Rather manually setup python (pip) before instead.
       - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v24.10.0
+        uses: https://github.com/ansible/ansible-lint@4ce8e497d462cf73b4d4fac1e97b4ace4f317dcc # v24.12.2
         with:
           setup_python: "false"
           requirements_file: "requirements.yml"
diff --git a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
index 228382b..ae4af57 100644
--- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
@@ -2,7 +2,7 @@
 services:
 
   prometheus:
-    image: docker.io/prom/prometheus:v3.7.1
+    image: docker.io/prom/prometheus:v3.7.2@sha256:23031bfe0e74a13004252caaa74eccd0d62b6c6e7a04711d5b8bf5b7e113adc7
     container_name: prometheus
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
diff --git a/roles/renovate/files/renovate.service b/roles/renovate/files/renovate.service
index ca9f7ed..6cb8f16 100644
--- a/roles/renovate/files/renovate.service
+++ b/roles/renovate/files/renovate.service
@@ -7,4 +7,6 @@ Wants=network-online.target
 Type=oneshot
 ExecStart=/usr/bin/docker run --rm \
     -v "/etc/renovate/config.js:/usr/src/app/config.js" \
+    --mount "type=volume,src=renovate,dst=/tmp/renovate" \
+    --env "RENOVATE_BASE_DIR=/tmp/renovate" \
     renovate/renovate