diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4a778290f3..13b7876968 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,14 +1,13 @@
-name: Publish
 on:
   workflow_dispatch:
     inputs:
-       projects:
+      projects:
         description: "Publish Workspaces (to DockerHub)"
         required: true
-       chain_type:
+      chain_type:
         description: "Select Chain Type"
         required: false
-       confirm:
+      confirm:
         description: "enter \"CONFIRM\" to process"
         required: true
 concurrency:
@@ -21,7 +20,9 @@ jobs:
   validate-projects:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Extract projects
         run: |
           export ALL_PROJECTS=$(yarn workspaces list --json | jq -csr '[ .[].name | select(. | startswith("web-") ) ]')
@@ -46,7 +47,9 @@ jobs:
         project: ${{ fromJSON(needs.validate-projects.outputs.projects) }}
     name: Publish ${{ matrix.project }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Assign chain type
         run: |
           node <<EOF | tee -a $GITHUB_OUTPUT
@@ -70,26 +73,26 @@ jobs:
           NEXT_PUBLIC_CHAIN_TYPE: ${{ github.event.inputs.chain_type }}
       - name: Set up QEMU
         if: ${{ steps.assign-chain-type.outputs.chain_type != '' }}
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a
       - name: Set up Docker Buildx
         if: ${{ steps.assign-chain-type.outputs.chain_type != '' }}
-        uses: docker/setup-buildx-action@v2
-      - name: Login to DockerHub 👤
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5
+      - name: 🐳 Login to DockerHub
         if: ${{ steps.assign-chain-type.outputs.chain_type != '' }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to Quay 👤
+      - name: 🐳 Login to Quay
         if: ${{ steps.assign-chain-type.outputs.chain_type != '' }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_ROBOT_TOKEN }}
       - name: Build and push Docker image
         if: ${{ steps.assign-chain-type.outputs.chain_type != '' }}
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@ca877d9245402d153a04124cb813731e3b162b5c
         with:
           context: .
           push: true
@@ -99,7 +102,8 @@ jobs:
             NEXT_PUBLIC_BANNERS_JSON=${{ secrets.BANNERS_JSON }}
             NEXT_PUBLIC_COINZILLA_ZONE=${{ secrets.COINZILLA_ZONE }}
             NEXT_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-            SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          secrets: |
+            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
           target: runner
           tags: |
             forbole/big-dipper-2.0-cosmos:monorepo-${{ matrix.project }}-${{ steps.assign-chain-type.outputs.chain_type }}-${{ steps.assign-chain-type.outputs.sha_short }}
diff --git a/Dockerfile b/Dockerfile
index 77a1a7788b..3c909239c6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -53,8 +53,6 @@ ARG NEXT_PUBLIC_WC_BRIDGE_URL
 ENV NEXT_PUBLIC_WC_BRIDGE_URL=${NEXT_PUBLIC_WC_BRIDGE_URL}
 ARG NEXT_PUBLIC_SENTRY_DSN
 ENV NEXT_PUBLIC_SENTRY_DSN=${NEXT_PUBLIC_SENTRY_DSN}
-ARG SENTRY_AUTH_TOKEN
-ENV SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN}
 ENV SENTRY_URL=https://sentry.io/
 ENV SENTRY_ORG=forbole
 ENV SENTRY_PROJECT=big-dipper
@@ -68,12 +66,16 @@ ENV TURBO_TEAM=${TURBO_TEAM}
 ARG TURBO_TOKEN
 ENV TURBO_TOKEN=${TURBO_TOKEN}
 
-RUN export SENTRYCLI_SKIP_DOWNLOAD=$([ -z "${NEXT_PUBLIC_SENTRY_DSN}" ] && echo 1) \
+RUN --mount=type=secret,id=sentry_auth_token,required=false \
+    if [ -f /run/secrets/sentry_auth_token ]; then SENTRY_AUTH_TOKEN=$(cat /run/secrets/sentry_auth_token) && export SENTRY_AUTH_TOKEN; fi \
+  && export SENTRYCLI_SKIP_DOWNLOAD="$([ -z "${NEXT_PUBLIC_SENTRY_DSN}" ] && echo 1)" \
   && corepack enable && yarn -v \
   && yarn install --inline-builds
 
 ## Build the project
-RUN ([ -z "${NEXT_PUBLIC_SENTRY_DSN}" ] || yarn node packages/shared-utils/configs/sentry/install.js) \
+RUN --mount=type=secret,id=sentry_auth_token,required=false \
+    if [ -f /run/secrets/sentry_auth_token ]; then SENTRY_AUTH_TOKEN=$(cat /run/secrets/sentry_auth_token) && export SENTRY_AUTH_TOKEN; fi \
+  && ([ -z "${NEXT_PUBLIC_SENTRY_DSN}" ] || yarn node packages/shared-utils/configs/sentry/install.js) \
   && yarn workspace ${PROJECT_NAME} add sharp \
   && yarn workspace ${PROJECT_NAME} run build
 
diff --git a/docker-compose.yml b/docker-compose.yml
index c992ca33c9..7967a09c2a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,14 +3,15 @@ version: "3.8"
 x-args: &args
   PROJECT_NAME: ${PROJECT_NAME:-web}
   NEXT_PUBLIC_CHAIN_TYPE: ${NEXT_PUBLIC_CHAIN_TYPE:-}
-  TURBO_TEAM: ${TURBO_TEAM:-}                         # for Turborepo remote cache
-  TURBO_TOKEN: ${TURBO_TOKEN:-}                       # for Turborepo remote cache
+  TURBO_TEAM: ${TURBO_TEAM:-}                          # for Turborepo remote cache
+  TURBO_TOKEN: ${TURBO_TOKEN:-}                        # for Turborepo remote cache
   NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN:-} # for Sentry.io
-  SENTRY_AUTH_TOKEN: ${SENTRY_AUTH_TOKEN:-}           # for Sentry.io
 
 x-build: &build
   context: .
   args: *args
+  secrets:
+    - sentry_auth_token
   target: runner
 
 x-web: &web
@@ -34,6 +35,11 @@ services:
       args:
         <<: *args
         BASE_IMAGE: arm64v8/node:18
+
+secrets:
+  sentry_auth_token:
+    environment: "SENTRY_AUTH_TOKEN"
+
 # Define a network, which allows containers to communicate
 # with each other, by using their container name as a hostname
 networks: