diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index eb48bea6..d05df30b 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -504,7 +504,7 @@ jobs:
         # Both builds below pull the base images; authenticated pulls are not
         # subject to the anonymous per-IP rate limit shared runners exhaust.
         if: steps.registry.outputs.login == 'true'
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550  # v4.8.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ac967be..dd09201e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -379,7 +379,7 @@ jobs:
       # that shared runners exhaust — 429 Too Many Requests on the base-image
       # manifests, four times on 2026-10-09 (issue #891).
       if: steps.registry.outputs.login == 'true'
-      uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550  # v4.8.0
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
         password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f2ea5224..2f696d78 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -148,7 +148,7 @@ jobs:
       uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
     
     - name: Log in to Docker Hub
-      uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550  # v4.8.0
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
         password: ${{ secrets.DOCKER_PASSWORD }}