diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 820244b..8411deb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
       # Exercise the Dockerfile build path so PRs catch regressions in the
       # toolchain image, bake spec, or runtime stage layout.
       - name: Bake binaries
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
         with:
           files: ./docker-bake.hcl
           targets: binaries
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4aa9c62..cd656b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -141,7 +141,7 @@ jobs:
 
       - name: Bake binaries + image
         id: bake
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
         env:
           RITE_BUILD_COMMIT: ${{ needs.validate.outputs.commit_sha }}
           RITE_BUILD_COMMIT_DATE: ${{ needs.validate.outputs.commit_date }}