diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
index 5e6ff1ffc2f..9cc0e8ca0b9 100644
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -53,7 +53,7 @@ runs:
         standalone: true
 
     - name: Setup Node
-      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3c9bf7d5b1c..d43a5648a4a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -698,7 +698,7 @@ jobs:
           show-progress: false
 
       - name: docker-config
-        uses: containerbase/internal-tools@6ace88c90ae392ff482dbfc7bbecf1bd53b306fc # v3.10.20
+        uses: containerbase/internal-tools@58012bf37e61c96af489185b723fe67a7b9b5c07 # v3.10.23
         with:
           command: docker-config
 
diff --git a/.github/workflows/update-data.yml b/.github/workflows/update-data.yml
index 641767a8b49..6c8b0bb46f7 100644
--- a/.github/workflows/update-data.yml
+++ b/.github/workflows/update-data.yml
@@ -27,7 +27,7 @@ jobs:
           standalone: true
 
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
diff --git a/docs/usage/docker.md b/docs/usage/docker.md
index c3f5a46617e..3ca030fddea 100644
--- a/docs/usage/docker.md
+++ b/docs/usage/docker.md
@@ -307,7 +307,7 @@ Renovate will get the credentials with the [`google-auth-library`](https://www.n
     service_account: ${{ env.SERVICE_ACCOUNT }}
 
 - name: renovate
-  uses: renovatebot/github-action@v41.0.19
+  uses: renovatebot/github-action@v41.0.20
   env:
     RENOVATE_HOST_RULES: |
       [