diff --git a/Dockerfile b/Dockerfile
index f440fa5..782ff74 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.14-alpine3.23@sha256:faee120f7885a06fcc9677922331391fa690d911c020abb9e8025ff3d908e510
+FROM python:3.14-alpine@sha256:a1321512d6a287428c50dcdf2ab3857761127e03a23b1f648e9c1c0de59288f8
 
 RUN apk add --no-cache curl jq && apk upgrade --no-cache zlib
 
@@ -9,7 +9,7 @@ COPY LICENSE \
         requirements.txt \
         /code/
 
-RUN pip install --no-cache-dir -r /code/requirements.txt
+RUN pip install --no-cache-dir --require-hashes -r /code/requirements.txt
 
 ENTRYPOINT ["/code/entrypoint.sh"]
 CMD []
diff --git a/README.md b/README.md
index e171e28..1a6c51a 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,18 @@ with:
   exclude_file: src/foo
 ```
 
+### Parameter: config
+
+Path to a `codespell` config file. The file uses INI format with a `[codespell]` section.
+
+This parameter is optional. By default `codespell` automatically reads configuration from `pyproject.toml`, `setup.cfg`, and `.codespellrc` in the working directory; use this parameter only to point at a config file in a non-standard location.
+
+```yml
+uses: codespell-project/actions-codespell@v2
+with:
+  config: path/to/codespell.cfg
+```
+
 ### Parameter: skip
 
 Comma-separated list of files to skip (it accepts globs as well).
diff --git a/requirements.txt b/requirements.txt
index 291f885..049fb09 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1,10 @@
-codespell[toml]>=2.2.4
+# Hashes enable pip's hash-checking mode (see
+# https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode),
+# required via --require-hashes in the Dockerfile. When bumping the version,
+# regenerate both hashes for the new release:
+#   pip download --no-deps codespell==<version>            # wheel
+#   pip download --no-deps --no-binary :all: codespell==<version>  # sdist
+#   pip hash <each downloaded file>
+codespell[toml]==2.4.3 \
+    --hash=sha256:af2505b335e8573dbd2d384d1c4ef498f4006f4ba2d6fceca01e55b91f52628a \
+    --hash=sha256:cbe085e331227b37bb86ef8bddd08dc768c704ee9a07ca869852c093fa2793e2