diff --git a/.github/workflows/reusable-trivy.yml b/.github/workflows/reusable-trivy.yml
index 87c224a..31ee3f8 100644
--- a/.github/workflows/reusable-trivy.yml
+++ b/.github/workflows/reusable-trivy.yml
@@ -188,7 +188,7 @@ jobs:
       # publishes to ghcr.io, so logging in here (not conditionally, not
       # registry-parsed from image-ref) covers every real usage.
       - name: Log in to GHCR for the image pull
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/sign-and-attest.yml b/.github/workflows/sign-and-attest.yml
index 396de6d..0d9e120 100644
--- a/.github/workflows/sign-and-attest.yml
+++ b/.github/workflows/sign-and-attest.yml
@@ -75,7 +75,7 @@ jobs:
       # registry auth docs). One GITHUB_TOKEN login covers the provenance
       # referrer push and every cosign push below.
       - name: Log in to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/verify-attestation.yml b/.github/workflows/verify-attestation.yml
index b06f453..f4cfb37 100644
--- a/.github/workflows/verify-attestation.yml
+++ b/.github/workflows/verify-attestation.yml
@@ -73,7 +73,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64  # v2.1.6
       - name: Log in to GHCR
         if: ${{ startsWith(inputs.image-ref, 'ghcr.io/') }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}