diff --git a/bootc-build/dnf-cache/action.yml b/bootc-build/dnf-cache/action.yml
index a95ca76..315da82 100644
--- a/bootc-build/dnf-cache/action.yml
+++ b/bootc-build/dnf-cache/action.yml
@@ -36,7 +36,7 @@ runs:
     - name: Restore DNF package cache
       id: restore
       if: inputs.action == 'restore'
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ${{ inputs.cache-path }}
         key: ${{ runner.os }}-${{ inputs.architecture }}-buildah-${{ inputs.image-flavor != '' && format('{0}-', inputs.image-flavor) || '' }}${{ inputs.cache-name }}${{ inputs.cache-bust != '' && format('-{0}', inputs.cache-bust) || '' }}
@@ -58,7 +58,7 @@ runs:
 
     - name: Save DNF package cache
       if: always() && !cancelled() && inputs.action == 'save' && inputs.allow-write == 'true'
-      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ${{ inputs.cache-path }}
         key: ${{ runner.os }}-${{ inputs.architecture }}-buildah-${{ inputs.image-flavor != '' && format('{0}-', inputs.image-flavor) || '' }}${{ inputs.cache-name }}${{ inputs.cache-bust != '' && format('-{0}', inputs.cache-bust) || '' }}
diff --git a/bootc-build/scan-image/action.yml b/bootc-build/scan-image/action.yml
index cb8d0fb..9df6db1 100644
--- a/bootc-build/scan-image/action.yml
+++ b/bootc-build/scan-image/action.yml
@@ -41,7 +41,7 @@ runs:
 
     - name: Restore Trivy vulnerability DB cache
       id: trivy-db-cache-restore
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ~/.cache/trivy
         key: trivy-db-${{ runner.os }}-${{ runner.arch }}-${{ steps.trivy-date.outputs.date }}
@@ -89,7 +89,7 @@ runs:
     - name: Save Trivy vulnerability DB cache
       # Only save on cache miss — DB is shared between the SARIF and JSON scan steps above.
       if: steps.trivy-db-cache-restore.outputs.cache-hit != 'true'
-      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ~/.cache/trivy
         key: ${{ steps.trivy-db-cache-restore.outputs.cache-primary-key }}
diff --git a/bootc-build/setup-runner/action.yml b/bootc-build/setup-runner/action.yml
index 42203ab..73dbd7c 100644
--- a/bootc-build/setup-runner/action.yml
+++ b/bootc-build/setup-runner/action.yml
@@ -61,7 +61,7 @@ runs:
     - name: Restore apt package cache
       if: inputs.update-podman == 'true'
       id: apt-cache-restore
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: /var/cache/apt/archives
         key: apt-resolute-podman-${{ runner.os }}-${{ runner.arch }}-${{ steps.apt-cache-key.outputs.week }}
@@ -87,7 +87,7 @@ runs:
 
     - name: Save apt package cache
       if: inputs.update-podman == 'true' && steps.apt-cache-restore.outputs.cache-hit != 'true'
-      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: /var/cache/apt/archives
         key: ${{ steps.apt-cache-restore.outputs.cache-primary-key }}
diff --git a/bootc-build/validate-pr/action.yml b/bootc-build/validate-pr/action.yml
index dcd7011..cf1bf69 100644
--- a/bootc-build/validate-pr/action.yml
+++ b/bootc-build/validate-pr/action.yml
@@ -41,7 +41,7 @@ runs:
       run: PIP_CONSTRAINT='' pip install 'pre-commit==4.6.0'
 
     - name: Cache pre-commit hooks
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ~/.cache/pre-commit
         key: ${{ runner.os }}-${{ runner.arch }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}