diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b516ff7cc..ea0399beb 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -187,7 +187,7 @@ jobs:
       # (packages: write above) — no PAT to expire or rotate.
       - name: Log in to GHCR (build push)
         if: ${{ !inputs.skip_build }}
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -195,7 +195,7 @@ jobs:
 
       - name: Log in to Docker Hub (build push)
         if: ${{ !inputs.skip_build && env.IMAGE_HUB != '' }}
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/test_deploy.yml b/.github/workflows/test_deploy.yml
index 95ca7ea9b..b4d45152d 100644
--- a/.github/workflows/test_deploy.yml
+++ b/.github/workflows/test_deploy.yml
@@ -166,7 +166,7 @@ jobs:
       # (packages: write above) — no PAT to expire or rotate.
       - name: Log in to GHCR (build push)
         if: ${{ !inputs.skip_build }}
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}