diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 83241e2d..45704a95 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install Go
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 374df32b..8c4deff9 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -28,6 +28,6 @@ jobs:
         run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
         if: github.repository == 'prometheus/snmp_exporter'
       - id: govulncheck
-        uses: golang/govulncheck-action@3fa7bd9cee2cfdf3499a8803b226e43de7b7cdb4 # master
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # master
         env:
           GOOS: ${{ contains(github.repository, 'windows_exporter') && 'windows' || '' }}
diff --git a/Makefile.common b/Makefile.common
index 5cfd6b8b..cd54cb41 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -165,8 +165,9 @@ common-deps:
 .PHONY: update-go-deps
 update-go-deps:
 	@echo ">> updating Go dependencies"
+	# GOTOOLCHAIN prevents go get from pulling deps that require a newer Go version.
 	@for m in $$($(GO) list -mod=readonly -m -f '{{ if and (not .Indirect) (not .Main)}}{{.Path}}{{end}}' all); do \
-		$(GO) get $$m; \
+		GOTOOLCHAIN=go$$($(GO) mod edit -json | jq -r .Go) $(GO) get $$m; \
 	done
 	$(GO) mod tidy
 
@@ -246,6 +247,7 @@ common-docker-repo-name:
 
 .PHONY: common-docker $(BUILD_DOCKER_ARCHS)
 common-docker: $(BUILD_DOCKER_ARCHS)
+# DOCKER_ARCHS holds promu architecture names, which are not OCI platform strings.
 $(BUILD_DOCKER_ARCHS): common-docker-%:
 	@for variant in $(DOCKERFILE_VARIANTS_WITH_NAMES); do \
 		dockerfile=$${variant#*:}; \
@@ -254,10 +256,16 @@ $(BUILD_DOCKER_ARCHS): common-docker-%:
 		if [ "$*" = "armv7" ]; then \
 			distroless_arch="arm"; \
 		fi; \
+		arch="$*"; \
+		case "$$arch" in \
+			armv*) docker_platform="linux/arm/v$${arch#armv}";; \
+			*)     docker_platform="linux/$$arch";; \
+		esac; \
 		if [ "$$dockerfile" = "Dockerfile" ]; then \
 			echo "Building default variant ($$variant_name) for linux-$* using $$dockerfile"; \
 			docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" \
 				-f $$dockerfile \
+				--platform "$$docker_platform" \
 				--build-arg ARCH="$*" \
 				--build-arg OS="linux" \
 				--build-arg DISTROLESS_ARCH="$$distroless_arch" \
@@ -271,6 +279,7 @@ $(BUILD_DOCKER_ARCHS): common-docker-%:
 			echo "Building $$variant_name variant for linux-$* using $$dockerfile"; \
 			docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)-$$variant_name" \
 				-f $$dockerfile \
+				--platform "$$docker_platform" \
 				--build-arg ARCH="$*" \
 				--build-arg OS="linux" \
 				--build-arg DISTROLESS_ARCH="$$distroless_arch" \