diff --git a/.github/workflows/client-build.yml b/.github/workflows/client-build.yml
index 46ef385c..87a8014e 100644
--- a/.github/workflows/client-build.yml
+++ b/.github/workflows/client-build.yml
@@ -48,7 +48,7 @@ jobs:
 
       # Multi-arch in one buildx push — apk add gettext is the only RUN, fine under QEMU.
       # All real CPU work (ng build) ran natively above; arch-sensitive part is just the nginx base layer.
-      - uses: docker/build-push-action@v7.0.0
+      - uses: docker/build-push-action@v7.1.0
         with:
           context: ./angular-client
           file: ./angular-client/Dockerfile.prebuilt
diff --git a/.github/workflows/scylla-build.yml b/.github/workflows/scylla-build.yml
index b63f31c3..308a2788 100644
--- a/.github/workflows/scylla-build.yml
+++ b/.github/workflows/scylla-build.yml
@@ -52,7 +52,7 @@ jobs:
 
       # No Docker layer cache (cache-from/cache-to: type=gha) — apt install openssl
       # is ~3s, and COPY invalidates every run anyway. Real build time is cargo, cached above.
-      - uses: docker/build-push-action@v7.0.0
+      - uses: docker/build-push-action@v7.1.0
         with:
           context: ./scylla-server
           file: ./scylla-server/Dockerfile.prebuilt