diff --git a/.github/workflows/deploy-social-demo.yml b/.github/workflows/deploy-social-demo.yml
index 2f757466..cd4f1b75 100644
--- a/.github/workflows/deploy-social-demo.yml
+++ b/.github/workflows/deploy-social-demo.yml
@@ -114,7 +114,7 @@ jobs:
 
       # Third-party actions are SHA-pinned — the rule and its reason are in
       # .github/actions/setup/action.yml. This workflow holds a registry credential.
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # The DO API token is used as both username and password — that is what the registry expects.
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0