diff --git a/.github/actions/build-leg/action.yml b/.github/actions/build-leg/action.yml
index d5376296..00ca23df 100644
--- a/.github/actions/build-leg/action.yml
+++ b/.github/actions/build-leg/action.yml
@@ -741,7 +741,7 @@ runs:
     # LOGGED — never a silent downgrade; tier-2 stands on level-2 either way.
     - name: Register qemu-user binfmt (verify=qemu-user)
       if: inputs.verify == 'qemu-user'
-      uses: docker/setup-qemu-action@v4.3.0
+      uses: docker/setup-qemu-action@v4.4.0
     - name: Validate the tier-2 builder under qemu-user (verify=qemu-user)
       if: inputs.verify == 'qemu-user'
       shell: bash
@@ -836,7 +836,7 @@ runs:
     # smokes). Cheap and idempotent.
     - name: Ensure qemu binfmt for foreign-arch host execution
       if: inputs.guest-platform == 'alpine' && inputs.guest-arch != 'x86_64' && runner.arch == 'X64'
-      uses: docker/setup-qemu-action@v4.3.0
+      uses: docker/setup-qemu-action@v4.4.0
 
     - name: Stage the provider for the in-VM full smoke
       if: steps.mode.outputs.exec == 'guest' && inputs.smoke == 'full'
diff --git a/.github/actions/guest/action.yml b/.github/actions/guest/action.yml
index d3cf528b..3e321cd8 100644
--- a/.github/actions/guest/action.yml
+++ b/.github/actions/guest/action.yml
@@ -117,7 +117,7 @@ runs:
     # harmless when the guest arch is native.
     - name: Register qemu binfmt
       if: inputs.platform == 'alpine'
-      uses: docker/setup-qemu-action@v4.3.0
+      uses: docker/setup-qemu-action@v4.4.0
 
     # Docker Hub's official alpine publishes NO loong64 manifest on any tag
     # (matrix dispatch #5, 2026-07-10). Alpine itself ships loongarch64 since
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 08a604ee..ac9e6c04 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -121,7 +121,7 @@ jobs:
       - uses: actions/setup-node@v7.0.0
         with:
           node-version-file: .tool-versions
-      - uses: docker/setup-qemu-action@v4.3.0   # fix-binary binfmt: host node spawns the s390x tjs
+      - uses: docker/setup-qemu-action@v4.4.0   # fix-binary binfmt: host node spawns the s390x tjs
       - uses: actions/download-artifact@v8.0.1
         with:
           name: tjs-linux-s390x-musl