diff --git a/.github/workflows/ci_pr_validation.yml b/.github/workflows/ci_pr_validation.yml
index eeb1299..239f82f 100644
--- a/.github/workflows/ci_pr_validation.yml
+++ b/.github/workflows/ci_pr_validation.yml
@@ -30,7 +30,7 @@ jobs:
 
             - name: Build Docker image (no push, just build)
               id: build
-              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+              uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
               with:
                 context: .
                 platforms: linux/amd64
diff --git a/.github/workflows/scheduled_build.yml b/.github/workflows/scheduled_build.yml
index 60fb276..e5e4851 100644
--- a/.github/workflows/scheduled_build.yml
+++ b/.github/workflows/scheduled_build.yml
@@ -31,7 +31,7 @@ jobs:
             # re-download the pinned external artifacts (ARM toolchain, CMake,
             # Ninja, Task) so we notice if an upstream URL or release disappears.
             - name: Build Docker image (no cache, no push)
-              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+              uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
               with:
                 context: .
                 platforms: linux/amd64