diff --git a/.gitea/workflows/build-base.yml b/.gitea/workflows/build-base.yml
index 4d1f1c5..c96a33f 100644
--- a/.gitea/workflows/build-base.yml
+++ b/.gitea/workflows/build-base.yml
@@ -33,7 +33,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push base image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: ./Dockerfile.base
diff --git a/.gitea/workflows/build-cli.yml b/.gitea/workflows/build-cli.yml
index c4af75a..423b588 100644
--- a/.gitea/workflows/build-cli.yml
+++ b/.gitea/workflows/build-cli.yml
@@ -36,7 +36,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push CLI image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: ./tools/coder-cli/Dockerfile
diff --git a/.gitea/workflows/build-terraform-shell.yml b/.gitea/workflows/build-terraform-shell.yml
index 8a97914..0e68193 100644
--- a/.gitea/workflows/build-terraform-shell.yml
+++ b/.gitea/workflows/build-terraform-shell.yml
@@ -36,7 +36,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push shell image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: ./tools/terraform-shell/Dockerfile