diff --git a/.github/workflows/cli-validate.yml b/.github/workflows/cli-validate.yml
index 50bf75e97..b8e34cabb 100644
--- a/.github/workflows/cli-validate.yml
+++ b/.github/workflows/cli-validate.yml
@@ -35,7 +35,7 @@ jobs:
       -
         name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/matrix@018cb6412ab401ebaa809aa5f85966b74628600f
+        uses: docker/bake-action/subaction/matrix@59cb1203cd42bcefd40a1b6d73b589e48c86040e
         with:
           files: ./cmd/cli/docker-bake.hcl
           target: validate
@@ -59,7 +59,7 @@ jobs:
           buildkitd-flags: --debug
       -
         name: Validate
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7
         with:
           files: ./cmd/cli/docker-bake.hcl
           targets: ${{ matrix.target }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ca9060c29..f254cae44 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -199,7 +199,7 @@ jobs:
           fetch-depth: 0
 
       - name: Generate release notes
-        uses: docker/docker-agent-action@3654ec391b070e247de2e2e3c1ff2519b6378b3a # v2.0.9
+        uses: docker/docker-agent-action@aaa657c53cc69ed15683cd8a985d86663a0e1594 # v2.1.0
         with:
           agent: .github/agents/release-notes-generator.yaml
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}