diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index f5322ba9..64bf9472 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -133,7 +133,7 @@ jobs:
           echo "ovos-releases ${REF} -> ${sha}"
           echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Expand bake targets
         id: targets
@@ -223,7 +223,7 @@ jobs:
           echo "::error::push=true but DOCKERHUB_USERNAME/DOCKERHUB_TOKEN are not set"
           exit 1
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Log in to GHCR (build cache)
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -288,7 +288,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
@@ -448,7 +448,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
diff --git a/.github/workflows/on-constraints.yml b/.github/workflows/on-constraints.yml
index 85546fe0..6cca1060 100644
--- a/.github/workflows/on-constraints.yml
+++ b/.github/workflows/on-constraints.yml
@@ -36,7 +36,7 @@ jobs:
       count: ${{ steps.sel.outputs.count }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
       - id: sel
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml
index 6e3d5fdc..fab5c58d 100644
--- a/.github/workflows/on-push.yml
+++ b/.github/workflows/on-push.yml
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
       - id: sel
         env:
           BEFORE: ${{ github.event.before }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 0cf67994..9f5a2c3d 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
       - id: sel
         env:
           BASE: ${{ github.event.pull_request.base.sha }}
diff --git a/.github/workflows/record-state.yml b/.github/workflows/record-state.yml
index 6a1a38ac..4848ad46 100644
--- a/.github/workflows/record-state.yml
+++ b/.github/workflows/record-state.yml
@@ -44,7 +44,7 @@ jobs:
           echo "run ${RUN_ID}: ${n} channel artifact(s)"
           [ "$n" = "0" ] && cat dl.err || true
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
         if: steps.dl.outputs.artifacts != '0'
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4