diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7ce95c5..2bd7825 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Image tag is the version without the leading 'v' (v0.5.24 → 0.5.24),
       # matching what the module index references. GITHUB_REF_NAME is the tag,
@@ -27,18 +27,18 @@ jobs:
         id: v
         run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-qemu-action@v3 # cross-build arm64 on the amd64 runner
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v4 # cross-build arm64 on the amd64 runner
+      - uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build & push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64 # run on Intel + Apple-silicon clusters