diff --git a/Dockerfile b/Dockerfile
index e0bb3ce2d7f0..5ce38cd16566 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/Dockerfile.dev b/Dockerfile.dev
index cdb2db56267c..1248979211b4 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 FROM mcr.microsoft.com/vscode/devcontainers/base:debian
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
diff --git a/machine/generic-x86-64 b/machine/generic-x86-64
index 6bb19cbb4878..1437338e418f 100644
--- a/machine/generic-x86-64
+++ b/machine/generic-x86-64
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/green b/machine/green
index e643b729937f..ecf9e467f2c0 100644
--- a/machine/green
+++ b/machine/green
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/khadas-vim3 b/machine/khadas-vim3
index 525bce6cef80..24e77dc99988 100644
--- a/machine/khadas-vim3
+++ b/machine/khadas-vim3
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/odroid-c2 b/machine/odroid-c2
index 825fa8ff1c96..0b0b59c19a04 100644
--- a/machine/odroid-c2
+++ b/machine/odroid-c2
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/odroid-c4 b/machine/odroid-c4
index b4b047c4c98f..f4493716ad70 100644
--- a/machine/odroid-c4
+++ b/machine/odroid-c4
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/odroid-m1 b/machine/odroid-m1
index 9261d92177b2..b1b70f0b4b30 100644
--- a/machine/odroid-m1
+++ b/machine/odroid-m1
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/odroid-n2 b/machine/odroid-n2
index 6fba7a579a0a..28d31addb205 100644
--- a/machine/odroid-n2
+++ b/machine/odroid-n2
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/qemuarm-64 b/machine/qemuarm-64
index a0d29ac1d3f9..033d7be442fb 100644
--- a/machine/qemuarm-64
+++ b/machine/qemuarm-64
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/qemux86-64 b/machine/qemux86-64
index aba112448642..0c1eff87228c 100644
--- a/machine/qemux86-64
+++ b/machine/qemux86-64
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/raspberrypi3-64 b/machine/raspberrypi3-64
index dbb7409c52c3..85784b2052d8 100644
--- a/machine/raspberrypi3-64
+++ b/machine/raspberrypi3-64
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/raspberrypi4-64 b/machine/raspberrypi4-64
index f966fe36dee9..6f6c0e31823f 100644
--- a/machine/raspberrypi4-64
+++ b/machine/raspberrypi4-64
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/raspberrypi5-64 b/machine/raspberrypi5-64
index 7ae624797486..93e5e315cf8e 100644
--- a/machine/raspberrypi5-64
+++ b/machine/raspberrypi5-64
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/machine/yellow b/machine/yellow
index 1a69e5dab8e1..c0ccd5e3c2a6 100644
--- a/machine/yellow
+++ b/machine/yellow
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
diff --git a/script/hassfest/docker.py b/script/hassfest/docker.py
index 4bc2270aceda..057d09fd772e 100644
--- a/script/hassfest/docker.py
+++ b/script/hassfest/docker.py
@@ -8,11 +8,17 @@ from homeassistant.util import executor, thread
 
 from .model import Config, Integration
 
+# Don't forget to update also Dockerfile.dev when updating this.
+_DOCKERFILE_SYNTAX_SHA = (
+    "2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769"  # 1.23.0
+)
+
 _GO2RTC_SHA = (
     "675c318b23c06fd862a61d262240c9a63436b4050d177ffc68a32710d9e05bae"  # 1.9.14
 )
 
-DOCKERFILE_TEMPLATE = r"""# Automatically generated by hassfest.
+DOCKERFILE_TEMPLATE = r"""# syntax=docker/dockerfile@sha256:{dockerfile_syntax}
+# Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
 ARG BUILD_FROM
@@ -97,7 +103,8 @@ _MACHINES = {
     "yellow": _MachineConfig(arch="aarch64", packages=("raspberrypi-utils",)),
 }
 
-_MACHINE_DOCKERFILE_TEMPLATE = r"""# Automatically generated by hassfest.
+_MACHINE_DOCKERFILE_TEMPLATE = r"""# syntax=docker/dockerfile@sha256:{dockerfile_syntax}
+# Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
 ARG BUILD_FROM=ghcr.io/home-assistant/{arch}-homeassistant:latest
@@ -118,13 +125,15 @@ def _generate_machine_dockerfile(
         extra_packages = ""
 
     return _MACHINE_DOCKERFILE_TEMPLATE.format(
+        dockerfile_syntax=_DOCKERFILE_SYNTAX_SHA,
         arch=machine_config.arch,
         extra_packages=extra_packages,
         machine=machine_name,
     )
 
 
-_HASSFEST_TEMPLATE = r"""# Automatically generated by hassfest.
+_HASSFEST_TEMPLATE = r"""# syntax=docker/dockerfile@sha256:{dockerfile_syntax}
+# Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
 FROM python:{python_version}-alpine
@@ -193,6 +202,7 @@ def _generate_files(config: Config) -> list[File]:
     files = [
         File(
             DOCKERFILE_TEMPLATE.format(
+                dockerfile_syntax=_DOCKERFILE_SYNTAX_SHA,
                 timeout=timeout,
                 go2rtc=_GO2RTC_SHA,
             ),
@@ -200,6 +210,7 @@ def _generate_files(config: Config) -> list[File]:
         ),
         File(
             _HASSFEST_TEMPLATE.format(
+                dockerfile_syntax=_DOCKERFILE_SYNTAX_SHA,
                 python_version=_get_python_version(config.root),
             ),
             config.root / "script/hassfest/docker/Dockerfile",
diff --git a/script/hassfest/docker/Dockerfile b/script/hassfest/docker/Dockerfile
index fbd9084128c4..ba620a02e838 100644
--- a/script/hassfest/docker/Dockerfile
+++ b/script/hassfest/docker/Dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker