diff --git a/docker-build-push/action.yml b/docker-build-push/action.yml
index 014f257..bdb5eb0 100644
--- a/docker-build-push/action.yml
+++ b/docker-build-push/action.yml
@@ -8,53 +8,53 @@ inputs:
   target:
     description: Target stage to build (optional)
     required: false
-    default: ''
+    default: ""
   token:
     description: GitHub token for registry authentication
     required: true
   context:
     description: Docker build context
     required: false
-    default: '.'
+    default: "."
   skip-push:
-    description: 'Skip image push even if conditions are met (default: false)'
+    description: "Skip image push even if conditions are met (default: false)"
     required: false
     default: false
   test-command:
-    description: 'Test command to run against built image. Receives IMAGE env var.'
+    description: "Test command to run against built image. Receives IMAGE env var."
     required: false
-    default: ''
+    default: ""
 
 outputs:
   short-sha:
-    description: 'Short commit SHA'
+    description: "Short commit SHA"
     value: ${{ steps.compute.outputs.short-sha }}
   registry-image:
-    description: 'Full registry path without tag (e.g. ghcr.io/cfpb/myapp)'
+    description: "Full registry path without tag (e.g. ghcr.io/cfpb/myapp)"
     value: ${{ steps.compute.outputs.registry-image }}
   mutable-version:
     description: 'Mutable tag, version only (e.g. "main", "pr-42", "v1.2.3")'
     value: ${{ steps.compute.outputs.mutable-version }}
   mutable-tag:
-    description: 'Mutable tag (e.g. ghcr.io/cfpb/myapp:main)'
+    description: "Mutable tag (e.g. ghcr.io/cfpb/myapp:main)"
     value: ${{ steps.compute.outputs.mutable-tag }}
   sha-version:
     description: 'SHA-based tag, version only (e.g. "main-abc1234", "pr-42-abc1234")'
     value: ${{ steps.compute.outputs.sha-version }}
   sha-tag:
-    description: 'SHA-based tag (e.g. ghcr.io/cfpb/myapp:main-abc1234)'
+    description: "SHA-based tag (e.g. ghcr.io/cfpb/myapp:main-abc1234)"
     value: ${{ steps.compute.outputs.sha-tag }}
   short-sha-tag:
-    description: 'Short commit SHA-based tag (e.g. ghcr.io/cfpb/myapp:abc1234)'
+    description: "Short commit SHA-based tag (e.g. ghcr.io/cfpb/myapp:abc1234)"
     value: ${{ steps.compute.outputs.short-sha-tag }}
   tags:
-    description: 'All pushable tags, comma-separated'
+    description: "All pushable tags, comma-separated"
     value: ${{ steps.compute.outputs.tags }}
   pushed:
-    description: 'Whether the image was pushed'
+    description: "Whether the image was pushed"
     value: ${{ steps.should-push.outputs.should-push }}
   digest:
-    description: 'Image digest (if pushed)'
+    description: "Image digest (if pushed)"
     value: ${{ steps.push.outputs.digest }}
 
 runs:
@@ -162,11 +162,11 @@ runs:
         fi
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
     - name: Build image
       id: build
-      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:
         context: ${{ inputs.context }}
         load: true
@@ -188,7 +188,7 @@ runs:
 
     - name: Log in to registry
       if: steps.should-push.outputs.pushed == 'true'
-      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}