diff --git a/.github/workflows/cli-validate.yml b/.github/workflows/cli-validate.yml
index 807dd3bfa..58dc08c2d 100644
--- a/.github/workflows/cli-validate.yml
+++ b/.github/workflows/cli-validate.yml
@@ -35,7 +35,7 @@ jobs:
       -
         name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/matrix@6614cfa25eff9a0b2b2697efb0b6159e7680d584
+        uses: docker/bake-action/subaction/matrix@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b
         with:
           files: ./cmd/cli/docker-bake.hcl
           target: validate
@@ -54,12 +54,12 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
         with:
           buildkitd-flags: --debug
       -
         name: Validate
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           files: ./cmd/cli/docker-bake.hcl
           targets: ${{ matrix.target }}
diff --git a/.github/workflows/dmr-daily-check.yml b/.github/workflows/dmr-daily-check.yml
index 1c3b84988..dd67488cd 100644
--- a/.github/workflows/dmr-daily-check.yml
+++ b/.github/workflows/dmr-daily-check.yml
@@ -22,7 +22,7 @@ jobs:
     
     steps:      
       - name: Set up Docker
-        uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23
+        uses: docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877
 
       - name: Install docker-model-plugin
         run: |
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 28bfac1a1..6c73fc4ff 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Set up Docker
         if: matrix.os == 'ubuntu-latest'
-        uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23
+        uses: docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877
 
       - name: Install build dependencies (Linux)
         if: matrix.os == 'ubuntu-latest'
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 7c304e556..5bf67dc2c 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -29,7 +29,7 @@ jobs:
           cache: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Run integration tests
         run: make integration-tests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d87e12bb..aca9a4170 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -199,7 +199,7 @@ jobs:
           fetch-depth: 0
 
       - name: Generate release notes
-        uses: docker/docker-agent-action@e96a4bb40cac114f64358621e1d08346c8eadc8c # v2.0.1
+        uses: docker/docker-agent-action@774b6e0e60d6c648b0f2dc43bd5221377a0a7420 # v2.0.2
         with:
           agent: .github/agents/release-notes-generator.yaml
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -339,14 +339,14 @@ jobs:
           echo "openvino=$OPENVINO_IMAGE" >> "$GITHUB_OUTPUT"
 
       - name: Log in to DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
         with:
           username: "docker"
           password: ${{ secrets.ORG_ACCESS_TOKEN }}
 
       - name: Set up Buildx
         id: buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
         with:
           version: "lab:latest"
           driver: cloud
@@ -362,7 +362,7 @@ jobs:
         run: docker buildx prune -af --builder ${{ steps.buildx.outputs.name }}
 
       - name: Build CPU image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-llamacpp
@@ -378,7 +378,7 @@ jobs:
           tags: ${{ steps.tags.outputs.cpu }}
 
       - name: Build CUDA image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-llamacpp
@@ -394,7 +394,7 @@ jobs:
           tags: ${{ steps.tags.outputs.cuda }}
 
       - name: Build vLLM CUDA image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-vllm
@@ -411,7 +411,7 @@ jobs:
           tags: ${{ steps.tags.outputs.vllm-cuda }}
 
       - name: Build SGLang CUDA image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-sglang
@@ -428,7 +428,7 @@ jobs:
           tags: ${{ steps.tags.outputs.sglang-cuda }}
 
       - name: Build ROCm image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-llamacpp
@@ -443,7 +443,7 @@ jobs:
           provenance: mode=max
           tags: ${{ steps.tags.outputs.rocm }}
       - name: Build MUSA image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-llamacpp
@@ -459,7 +459,7 @@ jobs:
           tags: ${{ steps.tags.outputs.musa }}
 
       - name: Build OpenVINO image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           file: Dockerfile
           target: final-llamacpp
@@ -491,7 +491,7 @@ jobs:
       # pushing an already-existing tag fails with "403 denied". Detect the
       # already-published tag on Docker Hub and skip the trigger instead.
       - name: Log in to DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
         with:
           username: "docker"
           password: ${{ secrets.ORG_ACCESS_TOKEN }}