diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 6789b37f..253f706a 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -133,7 +133,7 @@ jobs:
           path: target/release
       # upload-artifact drops the mode bits and the Dockerfile COPYs the files as they are.
       - run: chmod +x target/release/kloudlite-git*
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         # Default docker-container driver: required for `type=gha` cache, which the classic
         # `docker` driver cannot export to.
       - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 6db6753a..fa763beb 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -53,7 +53,7 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io