diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 634ee61a..4f6ef113 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -173,7 +173,7 @@ jobs:
       # in the dockerfile. native binaries themselves are pre-built per
       # arch by `build-binaries`; only the libs/cue helper stages execute
       # under emulation, which is cheap (apt-get + curl + sha256).
-      - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
         with:
           platforms: arm64
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0