diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c757036a..6d4af7f3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
       - name: Setup node
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3.5.0
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3.5.1
         with:
           node-version: '16.x'
           cache: 'yarn'
@@ -108,7 +108,7 @@ jobs:
         run: |
           git merge -m 'chore(release): merge main (${{ github.sha }})' ${{ github.sha }}
       - name: Setup node
-        uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3.5.0
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3.5.1
         with:
           node-version: '16.x'
       - name: Install project
diff --git a/src/docker.ts b/src/docker.ts
index 505505f7..f296ff0e 100644
--- a/src/docker.ts
+++ b/src/docker.ts
@@ -1,7 +1,7 @@
 class Docker {
   readonly repository = 'renovate/renovate';
   // renovate: datasource=docker depName=renovate/renovate versioning=docker
-  readonly tag = '32.236.2-slim';
+  readonly tag = '32.236.4-slim';
   readonly tagSuffix = '-slim';
 
   image(): string {