diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml
index a380d50..d8e8d8a 100644
--- a/.github/workflows/build-deploy.yml
+++ b/.github/workflows/build-deploy.yml
@@ -221,7 +221,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       # ⛔ The action does not cover big endian PowerPC, and nothing says so.
       # tonistiigi/binfmt, which it runs, ships nine emulators: aarch64, arm,
diff --git a/.github/workflows/freshness-image-pins.yml b/.github/workflows/freshness-image-pins.yml
index a30e6d7..25e4593 100644
--- a/.github/workflows/freshness-image-pins.yml
+++ b/.github/workflows/freshness-image-pins.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Set up QEMU
         if: steps.check.outputs.rc == '3'
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Test the bumps with the tests that guard a normal build
         if: steps.check.outputs.rc == '3'
diff --git a/.github/workflows/freshness-keyring.yml b/.github/workflows/freshness-keyring.yml
index 4799836..c2cadf7 100644
--- a/.github/workflows/freshness-keyring.yml
+++ b/.github/workflows/freshness-keyring.yml
@@ -125,7 +125,7 @@ jobs:
 
       - name: Set up QEMU
         if: steps.check.outputs.rc != '0'
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Test the bump with the tests that guard a normal build
         if: steps.check.outputs.rc != '0'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 372eb52..5acbda6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -132,7 +132,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       # ⛔ docker/setup-qemu-action registers no big endian PowerPC emulator and
       # says nothing about it. Ubuntu's qemu-user-static ships no binfmt