diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87dda31..bd55a15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     name: Lint & static checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - name: ShellCheck
         run: shellcheck scripts/*.sh dev.sh tests/*.sh
@@ -48,7 +48,7 @@ jobs:
     name: Build image & smoke test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - name: Build image and run smoke test
         # Retry to ride out transient Docker Hub pull rate-limits on shared runners.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6372279..0cbc424 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     name: Build, publish to GHCR, and release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       # Never publish an image that doesn't pass the smoke test. Retry to ride
       # out transient Docker Hub pull rate-limits on shared runners.
@@ -34,7 +34,7 @@ jobs:
           exit 1
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -42,7 +42,7 @@ jobs:
 
       - name: Derive image tags and labels
         id: meta
-        uses: docker/metadata-action@v6.1.0
+        uses: docker/metadata-action@v6.2.0
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -52,7 +52,7 @@ jobs:
 
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           push: true
@@ -60,13 +60,13 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Attest build provenance (keyless)
-        uses: actions/attest-build-provenance@v4.1.0
+        uses: actions/attest-build-provenance@v4.1.1
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.build.outputs.digest }}
           push-to-registry: true
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3.0.1
+        uses: softprops/action-gh-release@v3.0.2
         with:
           generate_release_notes: true