diff --git a/configuration/services/gitea.nix b/configuration/services/gitea.nix
index 7f49d32..4d6840f 100644
--- a/configuration/services/gitea.nix
+++ b/configuration/services/gitea.nix
@@ -1,6 +1,7 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 
-{
+let inherit (pkgs) dockerTools;
+in {
   users = {
     extraUsers.gitea = {
       uid = config.ids.uids.git;
@@ -19,6 +20,14 @@
     containers = {
       gitea = {
         image = "gitea/gitea:latest";
+        imageFile = dockerTools.pullImage {
+          imageName = "gitea/gitea";
+          imageDigest =
+            "sha256:67ccf27b427ec65fd7378d0999a3d94e9649f1953d2bb115864faa71ce7b9ec2";
+          sha256 = "1nmmb14lpvk2161q2gww5hppn2sa9qcq78k04c011szx07afq2jy";
+          finalImageName = "gitea/gitea";
+          finalImageTag = "latest";
+        };
         volumes = [ "gitea:/data:Z" "/etc/localtime:/etc/localtime:ro" ];
         dependsOn = [ "postgres" ];
 
@@ -39,9 +48,18 @@
 
       postgres = {
         image = "postgres:alpine";
+        imageFile = dockerTools.pullImage {
+          imageName = "postgres";
+          imageDigest =
+            "sha256:578ca5c8452c08a4e0f5e65b55dce5e1812fe63c8fee40ea837641031598e51e";
+          sha256 = "1xqg228a29qn3qmzchg65ykx7g3s2fszwp1zv24wxxy40py0bmwk";
+          finalImageName = "postgres";
+          finalImageTag = "alpine";
+        };
         environment = {
           POSTGRES_DB = "gitea";
           POSTGRES_USER = "gitea";
+          POSTGRES_PASSWORD = "insecure";
         };
         volumes = [ "gitea-postgres-14:/var/lib/postgresql/data" ];
       };