diff --git a/.github/workflows/ci-integration.yml b/.github/workflows/ci-integration.yml
index a59b44e..aaef73f 100644
--- a/.github/workflows/ci-integration.yml
+++ b/.github/workflows/ci-integration.yml
@@ -113,7 +113,7 @@ jobs:
           docker exec ploydok-ci-redis redis-cli ping | grep -q PONG
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # The Caddy image is an xcaddy build with nine plugins; rebuilding it from
       # scratch costs about 90s per run, so cache the layers between runs.
diff --git a/.github/workflows/release-images.yml b/.github/workflows/release-images.yml
index 474fbbc..bf89800 100644
--- a/.github/workflows/release-images.yml
+++ b/.github/workflows/release-images.yml
@@ -210,7 +210,7 @@ jobs:
           echo "candidate=${candidate}" >> "$GITHUB_OUTPUT"
           echo "promotion_tags=${promotion_tags}" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       - uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3
 
@@ -407,7 +407,7 @@ jobs:
           name: release-image-manifest-${{ github.sha }}
           path: /tmp/ploydok-release
 
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with: