diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b582b4e0..cbe36dd4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
       - name: Setup node
-        uses: actions/setup-node@d6e3b5539ed7e5ccd26c3459e26c7c817f4e9068 # renovate: tag=v2.3.1
+        uses: actions/setup-node@4d0182af5ead0b7bf53e87e49aa959476f5501d3 # renovate: tag=v2.3.2
         with:
           node-version: '12.x'
       - name: Install project
@@ -83,7 +83,7 @@ jobs:
         run: |
           git merge -m 'chore(release): merge main (${{ github.sha }})' ${{ github.sha }}
       - name: Setup node
-        uses: actions/setup-node@d6e3b5539ed7e5ccd26c3459e26c7c817f4e9068 # renovate: tag=v2.3.1
+        uses: actions/setup-node@4d0182af5ead0b7bf53e87e49aa959476f5501d3 # renovate: tag=v2.3.2
         with:
           node-version: '12.x'
       - name: Install project
diff --git a/src/docker.ts b/src/docker.ts
index 475f1cf1..187c18e2 100644
--- a/src/docker.ts
+++ b/src/docker.ts
@@ -1,7 +1,7 @@
 class Docker {
   readonly repository = 'renovate/renovate';
   // renovate: datasource=docker depName=renovate/renovate versioning=docker
-  readonly tag = '25.67.0-slim';
+  readonly tag = '25.67.1-slim';
   readonly tagSuffix = '-slim';
 
   image(): string {