diff --git a/.gitea/workflows/build-base.yml b/.gitea/workflows/build-base.yml
index a94d00a..5fea7d7 100644
--- a/.gitea/workflows/build-base.yml
+++ b/.gitea/workflows/build-base.yml
@@ -29,7 +29,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push base image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: ./Dockerfile.base
diff --git a/.gitea/workflows/build-cli.yml b/.gitea/workflows/build-cli.yml
index 8e1d642..27d7101 100644
--- a/.gitea/workflows/build-cli.yml
+++ b/.gitea/workflows/build-cli.yml
@@ -32,7 +32,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push CLI image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: ./tools/coder-cli/Dockerfile
diff --git a/.gitea/workflows/build-terraform-shell.yml b/.gitea/workflows/build-terraform-shell.yml
index 2c33b49..fb8b078 100644
--- a/.gitea/workflows/build-terraform-shell.yml
+++ b/.gitea/workflows/build-terraform-shell.yml
@@ -32,7 +32,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push shell image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: ./tools/terraform-shell/Dockerfile