diff --git a/.github/workflows/devcontainer-validate.yml b/.github/workflows/devcontainer-validate.yml
index befc8816..bf2a4d0d 100644
--- a/.github/workflows/devcontainer-validate.yml
+++ b/.github/workflows/devcontainer-validate.yml
@@ -50,10 +50,10 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Build devcontainer target
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         context: .
         file: ./Dockerfile
diff --git a/.github/workflows/docker-image-backfill.yml b/.github/workflows/docker-image-backfill.yml
index cc03e458..f060b2cc 100644
--- a/.github/workflows/docker-image-backfill.yml
+++ b/.github/workflows/docker-image-backfill.yml
@@ -167,10 +167,10 @@ jobs:
       run: git rev-parse HEAD > GIT_COMMIT
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Set up crane
       uses: ./.github/actions/setup-crane
@@ -239,7 +239,7 @@ jobs:
 
     - name: Export attested OCI layout for bundle backfill
       if: ${{ steps.bundle.outputs.exists != 'true' }}
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         annotations: ${{ steps.image.outputs.annotations }}
         context: .
diff --git a/.github/workflows/docker-image-preview-publish.yml b/.github/workflows/docker-image-preview-publish.yml
index 373c9548..609bd423 100644
--- a/.github/workflows/docker-image-preview-publish.yml
+++ b/.github/workflows/docker-image-preview-publish.yml
@@ -265,11 +265,11 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Build and push preview platform image
       id: build
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         annotations: ${{ steps.image.outputs.annotations }}
         context: .
@@ -424,7 +424,7 @@ jobs:
         ref: ${{ needs.prepare.outputs.checkout_ref }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Set up crane
       uses: ./.github/actions/setup-crane
@@ -564,7 +564,7 @@ jobs:
       run: git rev-parse HEAD > GIT_COMMIT
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Set up crane
       uses: ./.github/actions/setup-crane
@@ -591,7 +591,7 @@ jobs:
           --annotation-platform "${{ matrix.docker_platform }}"
 
     - name: Export attested platform OCI layout
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         annotations: ${{ steps.image.outputs.annotations }}
         context: .
diff --git a/.github/workflows/docker-image-security-scan.yml b/.github/workflows/docker-image-security-scan.yml
index c2dc251b..58c4304a 100644
--- a/.github/workflows/docker-image-security-scan.yml
+++ b/.github/workflows/docker-image-security-scan.yml
@@ -51,7 +51,7 @@ jobs:
 
     - name: Set up QEMU
       if: ${{ matrix.platform_id == 'amd64' }}
-      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
     - name: Sync and verify version metadata
       uses: ./.github/actions/sync-version-check
@@ -61,10 +61,10 @@ jobs:
       run: git rev-parse HEAD > GIT_COMMIT
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Build image for security scan
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         context: .
         file: ./Dockerfile
diff --git a/.github/workflows/docker-image-validate.yml b/.github/workflows/docker-image-validate.yml
index 022159f0..9525c460 100644
--- a/.github/workflows/docker-image-validate.yml
+++ b/.github/workflows/docker-image-validate.yml
@@ -122,7 +122,7 @@ jobs:
 
     - name: Set up QEMU
       if: ${{ matrix.platform_id == 'amd64' }}
-      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
     - name: Sync and verify version metadata
       uses: ./.github/actions/sync-version-check
@@ -132,10 +132,10 @@ jobs:
       run: git rev-parse HEAD > GIT_COMMIT
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Build validation image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         context: .
         file: ./Dockerfile
@@ -156,7 +156,7 @@ jobs:
           --platform "${{ matrix.docker_platform }}"
 
     - name: Export attested validation OCI layout
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         context: .
         file: ./Dockerfile
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5b353338..774cb6f0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -88,10 +88,10 @@ jobs:
       run: python3 scripts/verify-archive-single-worker.py
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
     - name: Build backend test image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       with:
         context: .
         file: ./Dockerfile