diff --git a/docker/mysql/8/debian12/8.0/Dockerfile b/docker/mysql/8/debian12/8.0/Dockerfile
index 680775fa6f..4b6ff74299 100644
--- a/docker/mysql/8/debian12/8.0/Dockerfile
+++ b/docker/mysql/8/debian12/8.0/Dockerfile
@@ -1,4 +1,4 @@
-FROM marketplace.gcr.io/google/debian12
+FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
 
 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
 RUN groupadd -r mysql && useradd -r -g mysql mysql
@@ -65,21 +65,7 @@ RUN echo "deb [ signed-by=/etc/apt/keyrings/mysql.gpg ] http://repo.mysql.com/ap
 
 # the "/var/lib/mysql" stuff here is because the mysql-server postinst doesn't have an explicit way to disable the mysql_install_db codepath besides having a database already "configured" (ie, stuff in /var/lib/mysql/mysql)
 # also, we set debconf keys to make APT a little quieter
-RUN { \
-    echo mysql-community-server mysql-community-server/data-dir select ''; \
-    echo mysql-community-server mysql-community-server/root-pass password ''; \
-    echo mysql-community-server mysql-community-server/re-root-pass password ''; \
-    echo mysql-community-server mysql-community-server/remove-test-db select false; \
-  } | debconf-set-selections \
-  && apt-get --allow-releaseinfo-change update \
-	&& apt-get install -y \
-    	mysql-community-client="${MYSQL_VERSION}" \
-		  mysql-community-server-core="${MYSQL_VERSION}" \
-  && rm -rf /var/lib/apt/lists/* \
-	&& rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \
-	&& chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \
-# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime
-	&& chmod 1777 /var/run/mysqld /var/lib/mysql
+
 
 VOLUME /var/lib/mysql
 # Config files
diff --git a/docker/mysql/exporter/Dockerfile b/docker/mysql/exporter/Dockerfile
index c3c999f4f3..9ab569d632 100644
--- a/docker/mysql/exporter/Dockerfile
+++ b/docker/mysql/exporter/Dockerfile
@@ -1,4 +1,5 @@
-FROM golang:1.21 as exporter-builder
+ARG BASE_REGISTRY="docker.io"
+FROM ${BASE_REGISTRY} /golang as exporter-builder
 
 ENV GOPATH /usr/local
 
@@ -28,7 +29,7 @@ RUN set -eux \
     && mkdir -p "${GOPATH}/src/github.com/prometheus/mysqld_exporter" \
     && tar -xzf /tmp/mysqld_exporter.tar.gz --strip-components=1 -C "${GOPATH}/src/github.com/prometheus/mysqld_exporter"
 
-FROM marketplace.gcr.io/google/debian12
+FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
 
 #resolve security issues
 RUN apt-get update; \
diff --git a/docker/mysql/templates/exporter/Dockerfile.template b/docker/mysql/templates/exporter/Dockerfile.template
index 969004a759..cbbe5c5389 100644
--- a/docker/mysql/templates/exporter/Dockerfile.template
+++ b/docker/mysql/templates/exporter/Dockerfile.template
@@ -2,7 +2,8 @@
 {{- $mysqld_exporter := index .Packages "mysqld_exporter" -}}
 {{- $template := index .TemplateArgs -}}
 
-FROM golang:{{ $golang.Minor }} as exporter-builder
+ARG BASE_REGISTRY="docker.io"
+FROM ${BASE_REGISTRY} /golang as exporter-builder
 
 ENV GOPATH /usr/local
 
diff --git a/docker/mysql/templates/mysql/Dockerfile.template b/docker/mysql/templates/mysql/Dockerfile.template
index bef57fd12e..13d0b5b1c7 100644
--- a/docker/mysql/templates/mysql/Dockerfile.template
+++ b/docker/mysql/templates/mysql/Dockerfile.template
@@ -71,31 +71,7 @@ RUN echo "deb [ signed-by=/etc/apt/keyrings/mysql.gpg ] http://repo.mysql.com/ap
 
 # the "/var/lib/mysql" stuff here is because the mysql-server postinst doesn't have an explicit way to disable the mysql_install_db codepath besides having a database already "configured" (ie, stuff in /var/lib/mysql/mysql)
 # also, we set debconf keys to make APT a little quieter
-RUN { \
-    echo mysql-community-server mysql-community-server/data-dir select ''; \
-    echo mysql-community-server mysql-community-server/root-pass password ''; \
-    echo mysql-community-server mysql-community-server/re-root-pass password ''; \
-    echo mysql-community-server mysql-community-server/remove-test-db select false; \
-  } | debconf-set-selections \
-  && apt-get --allow-releaseinfo-change update \
-	&& apt-get install -y \
-{{- if eq $mysql.Major "8.0" }}
-    	mysql-community-client="${MYSQL_VERSION}" \
-		  mysql-community-server-core="${MYSQL_VERSION}" \
-{{- else }}
-  		mysql-server="${MYSQL_VERSION}" \
-# comment out a few problematic configuration values
-	&& find /etc/mysql/ -name '*.cnf' -print0 \
-		| xargs -0 grep -lZE '^(bind-address|log)' \
-		| xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/' \
-# don't reverse lookup hostnames, they are usually another container
-	&& echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf \
-{{- end }}
-  && rm -rf /var/lib/apt/lists/* \
-	&& rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \
-	&& chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \
-# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime
-	&& chmod 1777 /var/run/mysqld /var/lib/mysql
+
 
 VOLUME /var/lib/mysql
 
diff --git a/docker/mysql/versions.yaml b/docker/mysql/versions.yaml
index 356927969d..bdc929879f 100644
--- a/docker/mysql/versions.yaml
+++ b/docker/mysql/versions.yaml
@@ -16,7 +16,7 @@
 
 
 cloudbuild:
-  docker_image: gcr.io/cloud-builders/docker:24.0.9
+  docker_image: gcr.io/cloud-builders/docker@sha256:1a9553236b25fd6e1bf2a864c8becb26782c429f4570695b27f4ad6f1a0ed75e
   enable_parallel: false
 versions:
 - annotations:
@@ -25,7 +25,7 @@ versions:
   dir: 8/debian12/8.0
   excludeTests:
   - tests/functional_tests/mysqld_exporter_test.yaml
-  from: marketplace.gcr.io/google/debian12
+  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
   packages:
     gosu:
       gpg: B42F6819007F00F88E364FD4036A9C25BF357DD4
@@ -54,7 +54,7 @@ versions:
   excludeTests:
   - tests/functional_tests/create_db_test.yaml
   - tests/functional_tests/remote_host_test.yaml
-  from: marketplace.gcr.io/google/debian12
+  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
   packages:
     golang:
       minor: '1.21'