diff --git a/.github/workflows/measure-classic-check.yml b/.github/workflows/measure-classic-check.yml
index 97894e9..5a5e9f5 100644
--- a/.github/workflows/measure-classic-check.yml
+++ b/.github/workflows/measure-classic-check.yml
@@ -93,7 +93,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Validate Classic Check inventory
         run: |
@@ -105,7 +105,7 @@ jobs:
 
       - name: Build task-focused Classic Check image
         id: classic-image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: windows/Dockerfile
diff --git a/.github/workflows/publish-linux.yml b/.github/workflows/publish-linux.yml
index 2dcfd09..5ebe326 100644
--- a/.github/workflows/publish-linux.yml
+++ b/.github/workflows/publish-linux.yml
@@ -86,7 +86,7 @@ jobs:
           } >> "${GITHUB_OUTPUT}"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -97,7 +97,7 @@ jobs:
 
       # Prove both Linux-owned image contracts before moving any release tag.
       - name: Build and smoke Classic validation target
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: linux/Dockerfile
@@ -130,7 +130,7 @@ jobs:
 
       - name: Validate portable baseline
         if: ${{ !inputs.candidate_only }}
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: portable/Dockerfile
@@ -142,7 +142,7 @@ jobs:
 
       - name: Load portable release candidate
         if: ${{ !inputs.candidate_only }}
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: portable/Dockerfile
@@ -165,7 +165,7 @@ jobs:
 
       - name: Build and publish Linux image
         if: ${{ !inputs.candidate_only }}
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: linux/Dockerfile
@@ -184,7 +184,7 @@ jobs:
             type=gha,mode=max,scope=linux-build-image,ignore-error=true
 
       - name: Build and publish Classic image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: linux/Dockerfile
@@ -208,7 +208,7 @@ jobs:
       - name: Publish immutable portable candidate
         if: ${{ !inputs.candidate_only }}
         id: portable-publish
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: portable/Dockerfile
diff --git a/.github/workflows/publish-windows.yml b/.github/workflows/publish-windows.yml
index 0c331fc..5535aaf 100644
--- a/.github/workflows/publish-windows.yml
+++ b/.github/workflows/publish-windows.yml
@@ -74,7 +74,7 @@ jobs:
             build/classic windows/classic-check-toolchain.json
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -85,7 +85,7 @@ jobs:
 
       - name: Build and publish immutable Windows candidate
         id: general-image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: windows/Dockerfile
@@ -106,7 +106,7 @@ jobs:
 
       - name: Build and publish immutable Classic Check candidate
         id: check-image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: windows/Dockerfile
@@ -209,7 +209,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index c9eba89..57389c9 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -144,10 +144,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Build Linux image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: linux/Dockerfile
@@ -252,7 +252,7 @@ jobs:
             build/classic windows/classic-check-toolchain.json
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Validate Classic Check inventory
         run: |
@@ -263,7 +263,7 @@ jobs:
             windows/classic-check-toolchain.json
 
       - name: Build general Windows image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: windows/Dockerfile
@@ -275,7 +275,7 @@ jobs:
 
       - name: Build task-focused Classic Check image
         id: classic-image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: windows/Dockerfile
@@ -378,10 +378,10 @@ jobs:
         run: echo "commit=$(jq -r '.consumer_validation.commit' classic-toolchain.json)" >> "${GITHUB_OUTPUT}"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Build and smoke Classic validation target
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: linux/Dockerfile
@@ -392,7 +392,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=classic-build-image,ignore-error=true
 
       - name: Load slim Classic image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: linux/Dockerfile
@@ -451,13 +451,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
 
       - name: Check portable Dockerfile
         run: docker build --check --file portable/Dockerfile .
 
       - name: Build and smoke baseline as non-root
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: portable/Dockerfile
@@ -468,7 +468,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=classic-portable-build-image,ignore-error=true
 
       - name: Load portable image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           file: portable/Dockerfile