diff --git a/ci/Dockerfile-envoy b/ci/Dockerfile-envoy
index 134511d21242..e2a8738d2e9f 100644
--- a/ci/Dockerfile-envoy
+++ b/ci/Dockerfile-envoy
@@ -1,5 +1,6 @@
 ARG BUILD_OS=ubuntu
-ARG BUILD_TAG=22.04@sha256:adbb90115a21969d2fe6fa7f9af4253e16d45f8d4c1e930182610c4731962658
+ARG BUILD_TAG=22.04
+ARG BUILD_SHA=adbb90115a21969d2fe6fa7f9af4253e16d45f8d4c1e930182610c4731962658
 ARG ENVOY_VRP_BASE_IMAGE=envoy-base
 
 
@@ -13,7 +14,7 @@ ADD "${TARGETPLATFORM}/release.tar.zst" /usr/local/bin/
 
 
 # STAGE: envoy-base
-FROM ${BUILD_OS}:${BUILD_TAG} AS envoy-base
+FROM ${BUILD_OS}:${BUILD_TAG}@sha256:${BUILD_SHA} AS envoy-base
 ENV DEBIAN_FRONTEND=noninteractive
 EXPOSE 10000
 CMD ["envoy", "-c", "/etc/envoy/envoy.yaml"]