diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c6ef149d23..4e5015e30f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
           make ${{ matrix.target }}
 
   binary:
-    uses: docker/github-builder/.github/workflows/bake.yml@v1
+    uses: docker/github-builder/.github/workflows/bake.yml@v1.4.0
     permissions:
       contents: read # same as global permission
       id-token: write # for signing attestation(s) with GitHub OIDC Token
@@ -111,7 +111,7 @@ jobs:
 
   bin-image-test:
     if: github.event_name == 'pull_request'
-    uses: docker/github-builder/.github/workflows/bake.yml@v1
+    uses: docker/github-builder/.github/workflows/bake.yml@v1.4.0
     with:
       runner: amd64
       target: image-cross
diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
index 1e0d37fd24f..902eb715346 100644
--- a/.github/workflows/merge.yml
+++ b/.github/workflows/merge.yml
@@ -83,7 +83,7 @@ jobs:
       - run: echo "Exposing env vars for reusable workflow"
 
   bin-image:
-    uses: docker/github-builder/.github/workflows/bake.yml@v1
+    uses: docker/github-builder/.github/workflows/bake.yml@v1.4.0
     needs:
       - bin-image-prepare
     permissions:
diff --git a/cmd/display/tty.go b/cmd/display/tty.go
index 0726ce27049..39e5fc946b2 100644
--- a/cmd/display/tty.go
+++ b/cmd/display/tty.go
@@ -176,13 +176,13 @@ func (w *ttyWriter) Start(ctx context.Context, operation string) {
 
 func (w *ttyWriter) Done(operation string, success bool) {
 	w.print()
+	w.done <- true
 	w.mtx.Lock()
 	defer w.mtx.Unlock()
 	if w.ticker != nil {
 		w.ticker.Stop()
 	}
 	w.operation = ""
-	w.done <- true
 }
 
 func (w *ttyWriter) On(events ...api.Resource) {
diff --git a/cmd/display/tty_test.go b/cmd/display/tty_test.go
index 0bbd35f2a29..9929e38ba42 100644
--- a/cmd/display/tty_test.go
+++ b/cmd/display/tty_test.go
@@ -18,6 +18,7 @@ package display
 
 import (
 	"bytes"
+	"context"
 	"strings"
 	"sync"
 	"testing"
@@ -422,3 +423,23 @@ func TestLenAnsi(t *testing.T) {
 		})
 	}
 }
+
+func TestDoneDeadlockFix(t *testing.T) {
+	w, _ := newTestWriter()
+	addTask(w, "test-task", "Working", "details", api.Working)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	w.Start(ctx, "test")
+	done := make(chan bool)
+	go func() {
+		w.Done("test", true)
+		done <- true
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Deadlock detected: Done() did not complete within 5 seconds")
+	}
+}