diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d58ed8da..335f23ad 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,7 +30,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2.4.0
       - name: Setup node
-        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458 # renovate: tag=v2.5.0
+        uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # renovate: tag=v2.5.1
         with:
           node-version: '12.x'
           cache: 'yarn'
@@ -104,7 +104,7 @@ jobs:
         run: |
           git merge -m 'chore(release): merge main (${{ github.sha }})' ${{ github.sha }}
       - name: Setup node
-        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458 # renovate: tag=v2.5.0
+        uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # renovate: tag=v2.5.1
         with:
           node-version: '12.x'
       - name: Install project
diff --git a/src/docker.ts b/src/docker.ts
index 63911a8a..f953da07 100644
--- a/src/docker.ts
+++ b/src/docker.ts
@@ -1,7 +1,7 @@
 class Docker {
   readonly repository = 'renovate/renovate';
   // renovate: datasource=docker depName=renovate/renovate versioning=docker
-  readonly tag = '31.13.6-slim';
+  readonly tag = '31.13.7-slim';
   readonly tagSuffix = '-slim';
 
   image(): string {