diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4e14f6565..31a8d2707 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -228,7 +228,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           # The oci-push registry login requires Tailscale + Vault, which only
           # works for `push` events (PR-labelled runs lack the right OIDC token).
@@ -257,7 +257,7 @@ jobs:
 
       - name: Docker meta (debug variant)
         id: meta-debug
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ghcr.io/element-hq/matrix-authentication-service