diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index c88982cc3..e6eb442dd 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -228,7 +228,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           # The oci-push registry login requires Tailscale + Vault, which only
           # works for `push` events (PR-labelled runs lack the right OIDC token).
@@ -257,7 +257,7 @@ jobs:
 
       - name: Docker meta (debug variant)
         id: meta-debug
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ghcr.io/element-hq/matrix-authentication-service