diff --git a/.github/workflows/docker-release.yaml b/.github/workflows/docker-release.yaml
index 07f7e56..a50c095 100644
--- a/.github/workflows/docker-release.yaml
+++ b/.github/workflows/docker-release.yaml
@@ -120,7 +120,7 @@ env:
   # Note ci.yaml's build-ability job passes NO version input and so never
   # broke — which is why every PR stayed green while every release died.
   # renovate: datasource=github-releases depName=docker/buildx
-  BUILDX_VERSION: v0.36.0
+  BUILDX_VERSION: v0.36.1
   # A cosign MAJOR is a breaking change even when the bump looks routine
   # (v2→v3 flipped sign-blob defaults and broke release SBOM signing) — majors
   # are not auto-merged; read the changelog before approving.