diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 6e99031..99ebc0a 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -78,7 +78,7 @@ jobs:
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/Dockerfile b/Dockerfile
index 4087f0a..cba65f5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Pinned by digest; Renovate proposes new digests
-FROM myoung34/github-runner:latest@sha256:ca22557c8e87ec11ffdba18b856d5fc40c8efed7e7840611f26ccf27a3f86c87
+FROM myoung34/github-runner:latest@sha256:28e963ec5e23024a2fa2af53ab7b5e39b292d8b62ee48cdeca5e9614b4b2544c
 
 # Install Claude Code Review dependencies
 USER root