diff --git a/.github/workflows/upstream-ci.yaml b/.github/workflows/upstream-ci.yaml
index 0b39744..0dea177 100644
--- a/.github/workflows/upstream-ci.yaml
+++ b/.github/workflows/upstream-ci.yaml
@@ -114,7 +114,7 @@ jobs:
         with:
           python-version: "3.14"
       - name: ⚡ Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v8.1.0
         with:
           version: "0.11.8"
       - name: 🧰 Install test dependencies
@@ -201,7 +201,7 @@ jobs:
           fi
       - name: 🚀 Build
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           push: false
           # Intentionally rely on image ID rather than tags for smoke testing.
diff --git a/.github/workflows/upstream-deploy.yaml b/.github/workflows/upstream-deploy.yaml
index ecdc3f0..ba6b28f 100644
--- a/.github/workflows/upstream-deploy.yaml
+++ b/.github/workflows/upstream-deploy.yaml
@@ -113,7 +113,7 @@ jobs:
           username: ${{ steps.registry.outputs.owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: 🚀 Build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           load: true
           # yamllint disable rule:line-length