diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 76cb432..4bdecd9 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -326,7 +326,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -455,7 +455,7 @@ jobs:
         if: >-
           needs.publish-gate.outputs.release_is_public != 'true' &&
           steps.image-provenance.outputs.present != 'true'
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-name: ${{ needs.publish-gate.outputs.image }}
           subject-digest: ${{ steps.select-image.outputs.digest }}
@@ -489,7 +489,7 @@ jobs:
         if: >-
           needs.publish-gate.outputs.release_is_public != 'true' &&
           steps.image-sbom.outputs.present != 'true'
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-name: ${{ needs.publish-gate.outputs.image }}
           subject-digest: ${{ steps.select-image.outputs.digest }}
@@ -524,7 +524,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -733,7 +733,7 @@ jobs:
         if: >-
           needs.publish-gate.outputs.release_is_public != 'true' &&
           steps.binary-provenance.outputs.present != 'true'
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-path: notify/dist/vaultsync-notify_*
 
@@ -765,7 +765,7 @@ jobs:
         if: >-
           needs.publish-gate.outputs.release_is_public != 'true' &&
           steps.binary-sbom.outputs.present != 'true'
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-path: notify/dist/vaultsync-notify_*
           sbom-path: notify/dist/SBOM.spdx.json
@@ -1512,7 +1512,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 9c4107f..9e411a1 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -176,7 +176,7 @@ jobs:
           printf '%s\n' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$'
           printf 'digest=%s\n' "$digest" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}