diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f2d9d3..636eb0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,7 +76,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Build container image without publishing
-        uses: docker/build-push-action@b66d8774c665b789105b440514f0c97e6f19b06f
+        uses: docker/build-push-action@502612d46437e573ecd598d11dd0b009741ed5cd
         with:
           context: .
           push: false
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 0abeb0d..64dedf0 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Extract image metadata
         id: meta
-        uses: docker/metadata-action@4378dc6be7f72231dfe78ac7e0364a44f1c9f54b
+        uses: docker/metadata-action@12e32e61d3439d838b9b6d3fda7d2f6a422f893d
         with:
           images: ${{ steps.vars.outputs.image_name }}
           tags: |
@@ -51,14 +51,14 @@ jobs:
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5c42dd293b89d96bae168b5b3694e4e72a5b1117
+        uses: docker/login-action@bb9683dca29f758cbd6ee832740e9f2dbeb21a3e
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and optionally publish image
-        uses: docker/build-push-action@b66d8774c665b789105b440514f0c97e6f19b06f
+        uses: docker/build-push-action@502612d46437e573ecd598d11dd0b009741ed5cd
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}