diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9f577e2..4ff1849 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -240,9 +240,9 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up pinned Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Log in to GHCR with the job token
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -265,7 +265,7 @@ jobs:
           } >>"$GITHUB_OUTPUT"
       - name: Build and push OCI image with SBOM and provenance
         id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true
@@ -279,7 +279,7 @@ jobs:
         with:
           cosign-release: ${{ env.COSIGN_VERSION }}
       - name: Create GitHub image provenance attestation
-        uses: actions/attest-build-provenance@62fc1d596301d0ab9914e1fec14dc5c8d93f65cd # v3.2.0
+        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
         with:
           subject-name: ${{ steps.image.outputs.image }}
           subject-digest: ${{ steps.build.outputs.digest }}