diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
index 4bb7d562..fca6bca9 100644
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -45,7 +45,7 @@ jobs:
 
       - name: Extract metadata (primary — aimock)
         id: meta-primary
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ env.PRIMARY_IMAGE }}
           tags: |
@@ -54,7 +54,7 @@ jobs:
 
       - name: Extract metadata (compat — llmock)
         id: meta-compat
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ env.COMPAT_IMAGE }}
           tags: |