diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6b6b9a7b..d736e150f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -397,7 +397,7 @@ jobs:
 
     - name: Set up Docker Buildx
       continue-on-error: true
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
 
     - name: Log in to Container Registry
       continue-on-error: true
diff --git a/.github/workflows/nvsim-server-docker.yml b/.github/workflows/nvsim-server-docker.yml
index 8f20e9889..f1976a454 100644
--- a/.github/workflows/nvsim-server-docker.yml
+++ b/.github/workflows/nvsim-server-docker.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
 
       # ghcr.io is always the target; there is no Docker Hub leg here.
       # The image path is derived from the repository owner because a fork
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 4b406ed77..ba73a0cd9 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -209,7 +209,7 @@ jobs:
 
     - name: Set up Docker Buildx
       continue-on-error: true
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Build Docker image for scanning
       continue-on-error: true
diff --git a/.github/workflows/sensing-server-docker.yml b/.github/workflows/sensing-server-docker.yml
index c8ee4a6a2..5a063e604 100644
--- a/.github/workflows/sensing-server-docker.yml
+++ b/.github/workflows/sensing-server-docker.yml
@@ -63,7 +63,7 @@ jobs:
       # by the runner, not built on a separate arm64 host).
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
 
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
 
       # Publish under the repository owner instead of a hard-coded `ruvnet`
       # namespace: a fork cannot push to the upstream's Docker Hub or ghcr.io