diff --git a/.github/workflows/apps-site-release.yml b/.github/workflows/apps-site-release.yml
index d129e4d..e7e258a 100644
--- a/.github/workflows/apps-site-release.yml
+++ b/.github/workflows/apps-site-release.yml
@@ -47,7 +47,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -70,7 +70,7 @@ jobs:
             org.opencontainers.image.description=Static marketing site served by nginx
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/site
           file: apps/site/Dockerfile
diff --git a/.github/workflows/apps-site-validate.yml b/.github/workflows/apps-site-validate.yml
index 082e786..f14d4da 100644
--- a/.github/workflows/apps-site-validate.yml
+++ b/.github/workflows/apps-site-validate.yml
@@ -65,7 +65,7 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.filter.outputs.code == 'true'
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Build the serving image with the same public configuration as release.
       # Running it read-only proves the container needs no writable root filesystem.
diff --git a/.github/workflows/infra-k3s-validate.yml b/.github/workflows/infra-k3s-validate.yml
index 9f40afe..3944f6c 100644
--- a/.github/workflows/infra-k3s-validate.yml
+++ b/.github/workflows/infra-k3s-validate.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Install kubectl (bundles kustomize)
         if: steps.filter.outputs.code == 'true'
-        uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
+        uses: azure/setup-kubectl@bda439f5f36b99b262ebdcd3613869bddb064c8e # v5.2.0
 
       - name: Set up Bun
         if: steps.filter.outputs.code == 'true'
diff --git a/.github/workflows/production-release.yml b/.github/workflows/production-release.yml
index f14b5c0..6a1b924 100644
--- a/.github/workflows/production-release.yml
+++ b/.github/workflows/production-release.yml
@@ -57,7 +57,7 @@ jobs:
         run: |
           git fetch origin main
           test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
@@ -67,7 +67,7 @@ jobs:
       # promoted until all four builds below have succeeded.
       - name: Build API candidate
         id: api
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/api
           file: apps/api/Dockerfile.prod
@@ -78,7 +78,7 @@ jobs:
           cache-to: type=gha,scope=release-api,mode=max
       - name: Build migrations candidate
         id: migrations
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/api
           file: apps/api/Dockerfile.prod
@@ -90,7 +90,7 @@ jobs:
           cache-to: type=gha,scope=release-migrations,mode=max
       - name: Build UI candidate
         id: ui
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/ui
           file: apps/ui/Dockerfile.prod
@@ -123,7 +123,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
       - name: Build site candidate
         id: site
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/site
           file: apps/site/Dockerfile