diff --git a/.github/workflows/cli-docker.yml b/.github/workflows/cli-docker.yml
index 71c2fb6..b843b03 100644
--- a/.github/workflows/cli-docker.yml
+++ b/.github/workflows/cli-docker.yml
@@ -131,7 +131,7 @@ jobs:
         uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349  # pin v3.7.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # pin v3.3.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # pin v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -140,7 +140,7 @@ jobs:
       - name: Log in to Docker Hub
         # Conditional — skip if secret not set (forks, self-hosted).
         if: steps.vars.outputs.dockerhub_image != ''
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # pin v3.3.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # pin v4.1.0
         with:
           registry: docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}