diff --git a/.github/workflows/llama-pin-check.yml b/.github/workflows/llama-pin-check.yml
index 7834356..87eb851 100644
--- a/.github/workflows/llama-pin-check.yml
+++ b/.github/workflows/llama-pin-check.yml
@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Compare pinned vs upstream digest
         id: check
diff --git a/.github/workflows/prerelease-server.yml b/.github/workflows/prerelease-server.yml
index 31fccc9..4423c2d 100644
--- a/.github/workflows/prerelease-server.yml
+++ b/.github/workflows/prerelease-server.yml
@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # Reminder (never fails the build) when upstream llama.cpp has moved past
       # the digest pinned in Dockerfile.cuda — keeps the deliberate pin honest.
diff --git a/.github/workflows/release-server.yml b/.github/workflows/release-server.yml
index f4d8920..aa5fa31 100644
--- a/.github/workflows/release-server.yml
+++ b/.github/workflows/release-server.yml
@@ -66,7 +66,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to Docker Hub
         uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
@@ -126,7 +126,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # Reminder (never fails the build) when upstream llama.cpp has moved past
       # the digest pinned in Dockerfile.cuda — keeps the deliberate pin honest.