diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index b27e001..9f83991 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -114,7 +114,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: stacks/go/net-http/rest
           file: stacks/go/net-http/rest/Dockerfile
@@ -178,7 +178,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: stacks/go/net-http/rest
           file: stacks/go/net-http/rest/Dockerfile
@@ -242,7 +242,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: stacks/nodejs/react-fastify/rest/web/Dockerfile
@@ -306,7 +306,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: stacks/nodejs/react-fastify/rest/bff/Dockerfile
@@ -368,7 +368,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: tests/Dockerfile
@@ -422,7 +422,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: tools/mcp
           file: tools/mcp/Dockerfile
@@ -489,7 +489,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: tools/mock-oauth
           file: tools/mock-oauth/Dockerfile
@@ -553,7 +553,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: .devcontainer/Dockerfile
diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml
index 647a349..f8c6d71 100644
--- a/.github/workflows/container-publish.yml
+++ b/.github/workflows/container-publish.yml
@@ -69,7 +69,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build and push versioned image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: stacks/go/net-http/rest
           file: stacks/go/net-http/rest/Dockerfile
@@ -134,7 +134,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build and push versioned image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ${{ matrix.dockerfile }}
@@ -191,7 +191,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build and push versioned image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: tests/Dockerfile
@@ -248,7 +248,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build and push versioned image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: tools/mcp
           file: tools/mcp/Dockerfile
@@ -305,7 +305,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build and push versioned image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: tools/mock-oauth
           file: tools/mock-oauth/Dockerfile
@@ -362,7 +362,7 @@ jobs:
             org.opencontainers.image.source=https://github.com/ourchitecture/idp
 
       - name: Build and push versioned image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: .devcontainer/Dockerfile
diff --git a/.github/workflows/pr-validate.yml b/.github/workflows/pr-validate.yml
index 028dbaa..d4c8c7d 100644
--- a/.github/workflows/pr-validate.yml
+++ b/.github/workflows/pr-validate.yml
@@ -326,7 +326,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build Go web container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: stacks/go/net-http/rest
           file: stacks/go/net-http/rest/Dockerfile
@@ -358,7 +358,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build Go BFF container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: stacks/go/net-http/rest
           file: stacks/go/net-http/rest/Dockerfile
@@ -390,7 +390,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build Node.js web container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: stacks/nodejs/react-fastify/rest/web/Dockerfile
@@ -422,7 +422,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build Node.js BFF container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: stacks/nodejs/react-fastify/rest/bff/Dockerfile
@@ -453,7 +453,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build contract tests container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: tests/Dockerfile
@@ -477,7 +477,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build MCP server container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: tools/mcp/Dockerfile
@@ -512,7 +512,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build mock-oauth container
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: tools/mock-oauth
           file: tools/mock-oauth/Dockerfile