diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 44450d6..d003203 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5
         with:
@@ -41,7 +41,7 @@ jobs:
     if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5
         with:
@@ -63,7 +63,7 @@ jobs:
     # only create a release on main builds:
     steps:
       - name: checkout code with full history (unshallow)
-        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -82,7 +82,7 @@ jobs:
           install-only: true
 
       - name: login to ghcr.io
-        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/licensing.yaml b/.github/workflows/licensing.yaml
index cc14da8..b986b7c 100644
--- a/.github/workflows/licensing.yaml
+++ b/.github/workflows/licensing.yaml
@@ -14,7 +14,7 @@ jobs:
   licensing:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml
index eb3ae65..58f8221 100644
--- a/.github/workflows/validate-renovate.yml
+++ b/.github/workflows/validate-renovate.yml
@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
         with:
diff --git a/Dockerfile b/Dockerfile
index b739813..7ebebdf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
-FROM pscale.dev/wolfi-prod/git:2.45.1@sha256:7eb398437c23eae3df0e9184d16a637252abe2bf18f0972d16350c7820b4d3c1
+FROM pscale.dev/wolfi-prod/git:2.45.1@sha256:e3860361253aec0410ab447be3cbce5ddd085e87683705b9e7484e90cbe86700
 
 COPY ghcommit /ghcommit