diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 070dd37..aa4848f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,7 +99,7 @@ jobs:
       # fires on qemu/** alone, so a change to machine/machine.go — the likeliest way to
       # get this wrong — never reaches it.
       - name: Log in to GitHub Packages
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/qemu.yml b/.github/workflows/qemu.yml
index 4ab5400..df91615 100644
--- a/.github/workflows/qemu.yml
+++ b/.github/workflows/qemu.yml
@@ -169,7 +169,7 @@ jobs:
       # business claiming the version tag.
       - name: Log in to GitHub Packages
         if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}