diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 195b0752..3b94cac0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -271,7 +271,7 @@ jobs:
       # live service pulls is exactly the drift the digest pin in compose
       # exists to prevent, and publishing one invites someone to use it.
       - name: Build and push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: build
         with:
           context: .