diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ef89f5605c4..6778c6e4343 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -112,7 +112,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build artifacts
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           targets: artifact-all
       -
@@ -140,7 +140,7 @@ jobs:
           if-no-files-found: error
       -
         name: Build image
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           files: |
             ./docker-bake.hcl
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index c843614e8e5..9c4914cd90a 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -26,7 +26,7 @@ jobs:
 
       -
         name: Build image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
       -
         name: Start distribution server
         run: |
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 2681345c652..9eae11ecd83 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,7 +30,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Build docs
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           files: |
             docker-bake.hcl
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 38d90b1d8be..f9b75eaa656 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -29,7 +29,7 @@ jobs:
 
       -
         name: Build image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           targets: image-local
       -