diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index aea8ea6..f189e56 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -44,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with: {registry: ghcr.io, username: "${{ github.actor }}", password: "${{ secrets.GITHUB_TOKEN }}"}
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
@@ -79,7 +79,7 @@ jobs:
           if [[ "$value" == "staging" && "$GITHUB_REF_NAME" != "develop" ]]; then echo "staging can only be promoted from develop" >&2; exit 1; fi
           echo "value=$value" >> "$GITHUB_OUTPUT"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with: {registry: ghcr.io, username: "${{ github.actor }}", password: "${{ secrets.GITHUB_TOKEN }}"}
       - env:
           CHANNEL: ${{ steps.channel.outputs.value }}
diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml
index 4ece82d..3d91513 100644
--- a/.github/workflows/rollback.yml
+++ b/.github/workflows/rollback.yml
@@ -17,7 +17,7 @@ jobs:
           if [[ "${{ inputs.environment }}" == "production" && "$GITHUB_REF_NAME" != "main" ]]; then echo "production rollback must run from main" >&2; exit 1; fi
           if [[ "${{ inputs.environment }}" == "staging" && "$GITHUB_REF_NAME" != "develop" ]]; then echo "staging rollback must run from develop" >&2; exit 1; fi
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with: {registry: ghcr.io, username: "${{ github.actor }}", password: "${{ secrets.GITHUB_TOKEN }}"}
       - shell: bash
         run: |