diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 8a2d27f..e2b3d1a 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -64,7 +64,7 @@ jobs:
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/dependabot-vendor-hash.yml b/.github/workflows/dependabot-vendor-hash.yml
index 9368fd7..61cc9fb 100644
--- a/.github/workflows/dependabot-vendor-hash.yml
+++ b/.github/workflows/dependabot-vendor-hash.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.head_ref }}
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
       - run: nix develop -c task nix:vendor-hash
 
       # A push with GITHUB_TOKEN starts no workflow runs, a workflow_dispatch is the exception, so
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 2e55503..7bb0c32 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
       - run: nix flake check --print-build-logs
       - run: nix build .#meshstack-cli --print-build-logs
       - run: ./result/bin/meshstack --version