diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml
index f433cd6a6..68d4725f9 100644
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -144,7 +144,7 @@ jobs:
         run: |
           docker buildx build \
             --platform "${{ matrix.platform }}" \
-            --build-arg "BASE_IMAGE=artifact.probo.inc/dockerhub/library/ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \
+            --build-arg "BASE_IMAGE=artifact.probo.inc/dockerhub/library/ubuntu@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \
             --tag "artifact.probo.inc/probo/probo:snapshot-${{ matrix.arch }}" \
             --load \
             .
diff --git a/.github/workflows/release-probod.yaml b/.github/workflows/release-probod.yaml
index d610c8617..fedd1849f 100644
--- a/.github/workflows/release-probod.yaml
+++ b/.github/workflows/release-probod.yaml
@@ -178,7 +178,7 @@ jobs:
         run: |
           docker buildx build \
             --platform "${PLATFORM}" \
-            --build-arg "BASE_IMAGE=artifact.probo.inc/dockerhub/library/ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \
+            --build-arg "BASE_IMAGE=artifact.probo.inc/dockerhub/library/ubuntu@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \
             --label "org.opencontainers.image.title=probod" \
             --label "org.opencontainers.image.description=Probo compliance management platform" \
             --label "org.opencontainers.image.url=https://github.com/getprobo/probo" \
diff --git a/GNUmakefile b/GNUmakefile
index 75a2ad7f6..b8f43a6f1 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -51,8 +51,10 @@ E2E_COVER_DIR ?= $(CURDIR)/coverage/e2e
 
 DOCKER_REGISTRY=	artifact.probo.inc
 DOCKER_PROXY=		$(DOCKER_REGISTRY)/dockerhub
-DOCKER_BASE_IMAGE=	ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b
-DOCKER_PROXY_BASE_IMAGE=	$(DOCKER_PROXY)/library/$(DOCKER_BASE_IMAGE)
+DOCKER_BASE_DIGEST=	sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b
+DOCKER_BASE_IMAGE=	ubuntu:24.04@$(DOCKER_BASE_DIGEST)
+# Harbor proxy resolves digest refs as library/<name>@sha256:..., not library/<name>:tag@sha256:...
+DOCKER_PROXY_BASE_IMAGE=	$(DOCKER_PROXY)/library/ubuntu@$(DOCKER_BASE_DIGEST)
 DOCKER_IMAGE_NAME=	$(DOCKER_REGISTRY)/probo/probo
 HELM_CHART_OCI=		oci://$(DOCKER_REGISTRY)/probo
 DOCKER_TAG_NAME?=	latest