diff --git a/.github/workflows/detect-releases.yml b/.github/workflows/detect-releases.yml
index 28f4c35..e3ed712 100644
--- a/.github/workflows/detect-releases.yml
+++ b/.github/workflows/detect-releases.yml
@@ -85,7 +85,7 @@ jobs:
       #     PASSWORD: ${{ secrets.PASSWORD }}
 
       - name: Commit with appropriate docker tag
-        uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
         with:
           commit_message: Update ${{ inputs.channel }} to ${{ needs.check-new-version.outputs.build_version }}
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index e00cd7c..bda4bc7 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Generate image tags from push tags/workflow input
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ghcr.io/extrange/ibkr
           flavor: |
diff --git a/Dockerfile.template b/Dockerfile.template
index 825342e..86e4c98 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -1,4 +1,4 @@
-FROM debian:13@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6 AS setup
+FROM debian:13@sha256:5cf544fad978371b3df255b61e209b373583cb88b733475c86e49faa15ac2104 AS setup
 
 ENV IBC_VERSION=3.22.0
 
diff --git a/latest/Dockerfile b/latest/Dockerfile
index 6714eec..b978aa4 100644
--- a/latest/Dockerfile
+++ b/latest/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:13@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6 AS setup
+FROM debian:13@sha256:5cf544fad978371b3df255b61e209b373583cb88b733475c86e49faa15ac2104 AS setup
 
 ENV IBC_VERSION=3.22.0
 
diff --git a/stable/Dockerfile b/stable/Dockerfile
index 6130338..5c9c7c0 100644
--- a/stable/Dockerfile
+++ b/stable/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:13@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6 AS setup
+FROM debian:13@sha256:5cf544fad978371b3df255b61e209b373583cb88b733475c86e49faa15ac2104 AS setup
 
 ENV IBC_VERSION=3.22.0