diff --git a/logic.rb b/logic.rb
index 680089b..3fb1809 100644
--- a/logic.rb
+++ b/logic.rb
@@ -75,7 +75,7 @@
 
 # Does a version check and self-update if required
 if options['self_update']
-  this_version = '3.3.0'
+  this_version = '3.4.0'
   puts colorize_lightblue("This is a universal dev env (version #{this_version})")
   # Skip version check if not on master (prevents infinite loops if you're in a branch that isn't up to date with the
   # latest release code yet)
diff --git a/scripts/add-aliases.sh b/scripts/add-aliases.sh
index b0b1f55..56e564d 100755
--- a/scripts/add-aliases.sh
+++ b/scripts/add-aliases.sh
@@ -20,7 +20,7 @@ alias psql17="$DC_CMD exec postgres-17 psql -h postgres-17 -U root -d"
 alias db2co="$DC_CMD exec --user db2inst1 db2_community bash -c '~/sqllib/bin/db2'"
 alias gitlist="bash $DEV_ENV_ROOT_DIR/scripts/git_list.sh"
 alias gitpull="bash $DEV_ENV_ROOT_DIR/scripts/git_pull.sh"
-alias cadence-cli="docker run --rm ubercadence/cli:0.7.0 --address host.docker.internal:7933"
+alias cadence-cli="docker run --rm docker.io/ubercadence/cli:v1.4.0@sha256:e89601a5d035f49a778a0505733082e3dfecc8629450d8dceaafc4de22b23cf2 --address host.docker.internal:7933"
 
 function bashin(){
   app_name=${@:1}
@@ -134,10 +134,10 @@ function format(){
 }
 
 function acceptance-test(){
-    run ${1} sh run_tests.sh ${@:2}
+    run ${1} sh run_tests.sh "${@:2}"
 }
 function acctest(){
-    run ${1} sh run_tests.sh ${@:2}
+    run ${1} sh run_tests.sh "${@:2}"
 }
 
 function acceptance-lint(){
diff --git a/scripts/docker/activemq/Dockerfile b/scripts/docker/activemq/Dockerfile
index 766c23f..4f0ea68 100644
--- a/scripts/docker/activemq/Dockerfile
+++ b/scripts/docker/activemq/Dockerfile
@@ -1,2 +1,2 @@
 # This is so a reset (dc down) won't remove the base AMQ image, only the one created from this dockerfile
-FROM docker.io/apache/activemq-classic:5.18.7
\ No newline at end of file
+FROM docker.io/apache/activemq-classic:5.19.2@sha256:887f680f015bb73ef4f8c4f1c4a14bdc0a260e5d755760f0d8a28826ffe433fb
\ No newline at end of file
diff --git a/scripts/docker/auth/keycloak/Dockerfile b/scripts/docker/auth/keycloak/Dockerfile
index e20521b..91b1d82 100644
--- a/scripts/docker/auth/keycloak/Dockerfile
+++ b/scripts/docker/auth/keycloak/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/keycloak/keycloak:9.0.3
+FROM quay.io/keycloak/keycloak:9.0.3@sha256:828e92baa29aee2fdf30cca0e0aeefdf77ca458d6818ebbd08bf26f1c5c6a7cf
 
 ADD development_realm.json /etc/keycloak/
 
diff --git a/scripts/docker/auth/openldap/Dockerfile b/scripts/docker/auth/openldap/Dockerfile
index 5e63494..c2a0e07 100644
--- a/scripts/docker/auth/openldap/Dockerfile
+++ b/scripts/docker/auth/openldap/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/lib/debian:11
+FROM docker.io/debian:11@sha256:19d6c1c4e66453a5d729cf13c3dcdb4708aeff1b2ed9886805afcda191f064b7
 
 # For some reason some people get hash mismatch issues. This tries to resolve that.
 # See https://askubuntu.com/questions/1121093/hash-sum-mismatches-in-18-04-on-laptop-and-in-docker
diff --git a/scripts/docker/cadence-web/Dockerfile b/scripts/docker/cadence-web/Dockerfile
index 6785c42..67bc365 100644
--- a/scripts/docker/cadence-web/Dockerfile
+++ b/scripts/docker/cadence-web/Dockerfile
@@ -1,2 +1,2 @@
 
-FROM docker.io/ubercadence/web:v3.35.6
+FROM docker.io/ubercadence/web:v3.35.6@sha256:875759010e1de59f90489ddedfc8dcbb24290391512703e0d82e93657a031155
diff --git a/scripts/docker/cadence/Dockerfile b/scripts/docker/cadence/Dockerfile
index 51e9a64..9930be9 100644
--- a/scripts/docker/cadence/Dockerfile
+++ b/scripts/docker/cadence/Dockerfile
@@ -1,2 +1,2 @@
 
-FROM docker.io/ubercadence/server:v1.2.18-auto-setup
+FROM docker.io/ubercadence/server:v1.2.18-auto-setup@sha256:f00181623a2d915f62843b26c37ef4eee13c6a209664eba5f0404c790040e5bb
diff --git a/scripts/docker/db2_community/Dockerfile b/scripts/docker/db2_community/Dockerfile
index 08b3a46..1e288e7 100644
--- a/scripts/docker/db2_community/Dockerfile
+++ b/scripts/docker/db2_community/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/hmlandregistry/db2-cgroupaware:11.5.9.0
+FROM docker.io/hmlandregistry/db2-cgroupaware:11.5.9.0@sha256:b505db3567ca183260f3d946c2c2d86f5c5ee1def45148fbe15eb0d85b41539e
 
 EXPOSE 50000 55000
 
diff --git a/scripts/docker/elasticsearch5/Dockerfile b/scripts/docker/elasticsearch5/Dockerfile
index fa88022..a5cb287 100644
--- a/scripts/docker/elasticsearch5/Dockerfile
+++ b/scripts/docker/elasticsearch5/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/elasticsearch:5.6.16
+FROM docker.io/elasticsearch:5.6.16@sha256:d0e119779df7ddf9d476102691d9d0b8783c13434e00d77f01327019c1297839
 
 ENV ES_JAVA_OPTS -Xms1024m -Xmx1024m
 
diff --git a/scripts/docker/elasticsearch7/Dockerfile b/scripts/docker/elasticsearch7/Dockerfile
index e2c64c4..8c0b10e 100644
--- a/scripts/docker/elasticsearch7/Dockerfile
+++ b/scripts/docker/elasticsearch7/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.elastic.co/elasticsearch/elasticsearch:7.17.28
+FROM docker.elastic.co/elasticsearch/elasticsearch:7.17.29@sha256:3f55a7f6f29b95345dc33808d6e914f81d125d4ca90a414e26c81a3521400980
 
 ENV ES_JAVA_OPTS="-Xms1024m -Xmx1024m"
 ENV discovery.type=single-node
diff --git a/scripts/docker/govuk-one-login/Dockerfile b/scripts/docker/govuk-one-login/Dockerfile
index a020377..ca5cc62 100644
--- a/scripts/docker/govuk-one-login/Dockerfile
+++ b/scripts/docker/govuk-one-login/Dockerfile
@@ -1 +1 @@
-FROM ghcr.io/govuk-one-login/simulator:latest
\ No newline at end of file
+FROM ghcr.io/govuk-one-login/simulator:26.05.9@sha256:b727307831986eaad96eee4f5e8a5c89ea5690c2a6d1e532b5e4c91735c627c3
diff --git a/scripts/docker/grafana/Dockerfile b/scripts/docker/grafana/Dockerfile
index 7f315ef..5b6fb96 100644
--- a/scripts/docker/grafana/Dockerfile
+++ b/scripts/docker/grafana/Dockerfile
@@ -1 +1 @@
-FROM grafana/grafana-oss:12.3.3
+FROM docker.io/grafana/grafana-oss:12.3.3@sha256:9e1e77ade304069aee3196e9a4f210830e96e80ce9a2640891eccc324b152faf
diff --git a/scripts/docker/localstack/Dockerfile b/scripts/docker/localstack/Dockerfile
index 369094c..dcee9dc 100644
--- a/scripts/docker/localstack/Dockerfile
+++ b/scripts/docker/localstack/Dockerfile
@@ -1 +1 @@
-FROM public.ecr.aws/localstack/localstack:2.3
+FROM public.ecr.aws/localstack/localstack:2.3@sha256:c396d899a3cdc038ba6bb82d54a40f12c037004b93c3e1efc4c821db60306f79
diff --git a/scripts/docker/logging/Dockerfile b/scripts/docker/logging/Dockerfile
index b8dd210..6aa4389 100644
--- a/scripts/docker/logging/Dockerfile
+++ b/scripts/docker/logging/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/lib/python:3.13.3-slim
+FROM docker.io/python:3.14.4-slim@sha256:c11aee3b3cae066f55d1e9318fc812673aa6557073b0db0d792b59491b262e0c
 
 ENV PYTHONUNBUFFERED=yes
 COPY tini server.py run.sh /
diff --git a/scripts/docker/nginx/Dockerfile b/scripts/docker/nginx/Dockerfile
index 0d1b269..3f453ba 100644
--- a/scripts/docker/nginx/Dockerfile
+++ b/scripts/docker/nginx/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/lib/nginx:1.27
+FROM docker.io/nginx:1.30.0@sha256:1a9ab83e2892b75773978e8d91f42a7a2a0d8bb704959a51ff17c0377481973d
 
 RUN rm /etc/nginx/conf.d/default.conf && \
   mkdir /etc/nginx/ssl && \
diff --git a/scripts/docker/postgres-13/Dockerfile b/scripts/docker/postgres-13/Dockerfile
index 4a2ffc3..f4e2626 100644
--- a/scripts/docker/postgres-13/Dockerfile
+++ b/scripts/docker/postgres-13/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/lib/postgres:13
+FROM docker.io/postgres:13.23@sha256:4689940c683801b4ab839ab3b0a0a3555a5fe425371422310944e89eca7d8068
 
 # For some reason some people get hash mismatch issues. This tries to resolve that.
 # See https://askubuntu.com/questions/1121093/hash-sum-mismatches-in-18-04-on-laptop-and-in-docker
diff --git a/scripts/docker/postgres-17/Dockerfile b/scripts/docker/postgres-17/Dockerfile
index fa16fab..ce681a1 100644
--- a/scripts/docker/postgres-17/Dockerfile
+++ b/scripts/docker/postgres-17/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/lib/postgres:17
+FROM docker.io/postgres:17.9@sha256:5b96f1a16bd9768b060dd2ffe55cb6225c4d9ef4d214a8b21eb08134869a97e4
 
 # Install the PostGIS extension
 RUN apt-get update && \
diff --git a/scripts/docker/prometheus/Dockerfile b/scripts/docker/prometheus/Dockerfile
index 25c4202..225205a 100644
--- a/scripts/docker/prometheus/Dockerfile
+++ b/scripts/docker/prometheus/Dockerfile
@@ -1,2 +1,3 @@
-FROM prom/prometheus:v3.9.1
+FROM docker.io/prom/prometheus:v3.11.2@sha256:3674db04d3640d2157de57f8679dbe8dbc10a673e6d63ec58d9430e34abbfe68
+
 COPY prometheus.yml /etc/prometheus/prometheus.yml
diff --git a/scripts/docker/rabbitmq-4/Dockerfile b/scripts/docker/rabbitmq-4/Dockerfile
index 6743cb6..debccf2 100644
--- a/scripts/docker/rabbitmq-4/Dockerfile
+++ b/scripts/docker/rabbitmq-4/Dockerfile
@@ -1,20 +1,17 @@
-# This is so a reset (dc down) won't remove the base rabbit image, only the one created from this dockerfile
-FROM docker.io/rabbitmq:4.2-management-alpine
+FROM docker.io/rabbitmq:4.2.6-management-alpine@sha256:cef1d5e13ce97724aa78b94e36e50fbe174a7623b8912da8b293dec1510a947f
 # Copy the configuration file to rabbitmq
 # https://www.rabbitmq.com/configure.html#configuration-files
 COPY rabbitmq.conf /etc/rabbitmq/
 # Copy certs for TLS
 # Nice tool here from rabbit for generating https://github.com/rabbitmq/tls-gen
 COPY certs/ca_certificate.pem certs/server_certificate.pem certs/server_key.pem certs/
-# This plugin adds a consistent-hash exchange type to RabbitMQ. This exchange type uses consistent hashing to 
+# rabbitmq_consistent_hash_exchange: This plugin adds a consistent-hash exchange type to RabbitMQ. This exchange type uses consistent hashing to 
 # distribute messages between the bound queues
-RUN rabbitmq-plugins --offline enable rabbitmq_consistent_hash_exchange
-# This is a RabbitMQ plugin adds message transfer and management functionality.
+# rabbitmq_shovel: This is a RabbitMQ plugin adds message transfer and management functionality.
 # Handy for tasks such as bulk moving msgs for a DLQ.
 # https://www.rabbitmq.com/shovel.html
-RUN rabbitmq-plugins --offline enable rabbitmq_shovel rabbitmq_shovel_management
-# This is a RabbitMQ plugin that exposes streams. 
+# rabbitmq_stream: This is a RabbitMQ plugin that exposes streams. 
 # Streams are a new persistent and replicated data structure, handy to persist historic messages for a period of time
 # https://www.rabbitmq.com/stream.html
-RUN rabbitmq-plugins --offline enable rabbitmq_stream && \
-    rabbitmq-plugins --offline enable rabbitmq_prometheus
+# rabbitmq_prometheus: Expose Prometheus metrics for monitoring/dashboards.
+RUN rabbitmq-plugins --offline enable rabbitmq_consistent_hash_exchange rabbitmq_shovel rabbitmq_shovel_management rabbitmq_stream rabbitmq_prometheus
diff --git a/scripts/docker/rabbitmq/Dockerfile b/scripts/docker/rabbitmq/Dockerfile
index 07aa02b..d846c97 100644
--- a/scripts/docker/rabbitmq/Dockerfile
+++ b/scripts/docker/rabbitmq/Dockerfile
@@ -1,21 +1,18 @@
-# This is so a reset (dc down) won't remove the base rabbit image, only the one created from this dockerfile
-FROM quay.io/lib/rabbitmq:3-management
+FROM docker.io/rabbitmq:3.13.7-management@sha256:e582c0bc7766f3342496d8485efb5a1df782b5ce3886ad017e2eaae442311f69
+
 # Copy the configuration file to rabbitmq
 # https://www.rabbitmq.com/configure.html#configuration-files
 COPY rabbitmq.conf /etc/rabbitmq/
 # Copy certs for TLS
 # Nice tool here from rabbit for generating https://github.com/rabbitmq/tls-gen
 COPY certs/ca_certificate.pem certs/server_certificate.pem certs/server_key.pem certs/
-# This plugin adds a consistent-hash exchange type to RabbitMQ. This exchange type uses consistent hashing to 
+# rabbitmq_consistent_hash_exchange: This plugin adds a consistent-hash exchange type to RabbitMQ. This exchange type uses consistent hashing to 
 # distribute messages between the bound queues
-RUN rabbitmq-plugins --offline enable rabbitmq_consistent_hash_exchange
-# This is a RabbitMQ plugin adds message transfer and management functionality.
+# rabbitmq_shovel: This is a RabbitMQ plugin adds message transfer and management functionality.
 # Handy for tasks such as bulk moving msgs for a DLQ.
 # https://www.rabbitmq.com/shovel.html
-RUN rabbitmq-plugins --offline enable rabbitmq_shovel rabbitmq_shovel_management
-# This is a RabbitMQ plugin that exposes streams. 
+# rabbitmq_stream: This is a RabbitMQ plugin that exposes streams. 
 # Streams are a new persistent and replicated data structure, handy to persist historic messages for a period of time
 # https://www.rabbitmq.com/stream.html
-# Expose Prometheus metrics for monitoring/dashboards.
-RUN rabbitmq-plugins --offline enable rabbitmq_stream && \
-    rabbitmq-plugins --offline enable rabbitmq_prometheus
+# rabbitmq_prometheus: Expose Prometheus metrics for monitoring/dashboards.
+RUN rabbitmq-plugins --offline enable rabbitmq_consistent_hash_exchange rabbitmq_shovel rabbitmq_shovel_management rabbitmq_stream rabbitmq_prometheus
diff --git a/scripts/docker/redis/Dockerfile b/scripts/docker/redis/Dockerfile
index 7fc42bf..2414af2 100644
--- a/scripts/docker/redis/Dockerfile
+++ b/scripts/docker/redis/Dockerfile
@@ -1,2 +1,2 @@
 # This is so a reset (dc down) won't remove the base redis image, only the one created from this dockerfile
-FROM quay.io/lib/redis:7.0
+FROM docker.io/redis:7.4.8@sha256:3e0669e42d4fe421c9dea0ba5fbc04d336b80b4f32a6c7d25bee3a1d089288a1
diff --git a/scripts/docker/squid/Dockerfile b/scripts/docker/squid/Dockerfile
index 6a4b4e6..2f6165d 100644
--- a/scripts/docker/squid/Dockerfile
+++ b/scripts/docker/squid/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/landregistry/squid:6
+FROM ghcr.io/landregistry/squid:7-20260513-123608@sha256:22bb1f86d4e7f7d9f45b78605288c7b5339e07c8661229c7f93eca76f32a9560
 # We have this as a Dockerfile rather than just specifying the image in the
 # compose fragment, to prevent it being deleted in a destroy, so it doesn't
 # need to be redownloaded
diff --git a/scripts/docker/swagger/Dockerfile b/scripts/docker/swagger/Dockerfile
new file mode 100644
index 0000000..e7a3e38
--- /dev/null
+++ b/scripts/docker/swagger/Dockerfile
@@ -0,0 +1 @@
+FROM docker.swagger.io/swaggerapi/swagger-ui:v5.32.4@sha256:8ce1bf994f0724b4511046449d48ade898f919b79c4f800075173d4e97741aa2
diff --git a/scripts/docker/swagger/compose-fragment.yml b/scripts/docker/swagger/compose-fragment.yml
index 5769658..9419a40 100644
--- a/scripts/docker/swagger/compose-fragment.yml
+++ b/scripts/docker/swagger/compose-fragment.yml
@@ -1,7 +1,7 @@
 services:
   swagger:
     container_name: swagger
-    image: docker.swagger.io/swaggerapi/swagger-ui
+    build: ../scripts/docker/swagger/
     ports:
       - 5101:8080
     platform: "linux/amd64"
diff --git a/scripts/docker/valkey/Dockerfile b/scripts/docker/valkey/Dockerfile
index 9cc8e7d..25ee38f 100644
--- a/scripts/docker/valkey/Dockerfile
+++ b/scripts/docker/valkey/Dockerfile
@@ -1 +1 @@
-FROM ghcr.io/valkey-io/valkey:8.1
+FROM ghcr.io/valkey-io/valkey:8.1.6-alpine@sha256:1cb6b20b70d927560cc4cc5397b5f045e74aa603ff7696274778880bb6fadc75
diff --git a/scripts/docker/wiremock/Dockerfile b/scripts/docker/wiremock/Dockerfile
index 0456609..dc7be15 100644
--- a/scripts/docker/wiremock/Dockerfile
+++ b/scripts/docker/wiremock/Dockerfile
@@ -1,6 +1,6 @@
-FROM quay.io/lib/eclipse-temurin:21-jre-ubi9-minimal
+FROM docker.io/eclipse-temurin:25.0.2_10-jre-ubi10-minimal@sha256:c897ce903faf6736e4b5cbb2dd5e05e6b74909d71105f3cfe33840b3ce7b8b21
 
-ARG WM_VERSION=3.12.1
+ARG WM_VERSION=3.13.2
 
 RUN mkdir -p /wiremock/mappings && cd /wiremock && \
     curl -sSL -o wiremock.jar https://repo1.maven.org/maven2/org/wiremock/wiremock-standalone/$WM_VERSION/wiremock-standalone-$WM_VERSION.jar