diff --git a/.github/workflows/docker-dependency-updater.yml b/.github/workflows/docker-dependency-updater.yml
index c7a9172a..a289841e 100644
--- a/.github/workflows/docker-dependency-updater.yml
+++ b/.github/workflows/docker-dependency-updater.yml
@@ -20,7 +20,11 @@ env:
   REPORT_PATH: docker-dependency-report.json
   UPDATE_BRANCH: docker-dependency-updates
   PR_TITLE: "chore(deps): docker dependency upgrade"
-  PR_AUTO_MERGE: "true"
+  PR_TEAM_REVIEWER: worker
+  PR_LABELS: |-
+    docker
+    dependencies
+  PR_AUTO_MERGE: "false"
   PR_MERGE_METHOD: squash
   COMMIT_MESSAGE: "chore(deps): update Docker dependency pins"
   COPILOT_PROMPT_PARTS: >-
@@ -55,7 +59,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Load dependency updater defaults
         id: config
@@ -141,11 +145,12 @@ jobs:
 
     permissions:
       contents: write
+      issues: write
       pull-requests: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
 
@@ -374,14 +379,17 @@ jobs:
       - name: Create pull request
         id: create-pr
         if: steps.changes.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        uses: peter-evans/create-pull-request@v8
         timeout-minutes: 5
         with:
+          token: ${{ secrets.GH_TOKEN }}
           commit-message: ${{ needs.config.outputs.commit_message }}
           title: ${{ needs.config.outputs.pr_title }}
           body-path: docker-dependency-pr-body.md
           branch: ${{ needs.config.outputs.update_branch }}
           add-paths: ${{ needs.config.outputs.dockerfile }}
+          labels: ${{ env.PR_LABELS }}
+          team-reviewers: ${{ env.PR_TEAM_REVIEWER }}
           draft: false
           delete-branch: true
 
@@ -409,7 +417,7 @@ jobs:
           esac
 
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
           MERGE_METHOD: ${{ needs.config.outputs.pr_merge_method }}
           PR_URL: ${{ steps.create-pr.outputs.pull-request-url }}
 
diff --git a/.github/workflows/docker-ops.yml b/.github/workflows/docker-ops.yml
index c6a800ec..56ae143e 100644
--- a/.github/workflows/docker-ops.yml
+++ b/.github/workflows/docker-ops.yml
@@ -45,7 +45,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Build worker image
         run: make build IMAGE_NAME=worker-runtime-output TAG="${GITHUB_SHA}"