diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
index 709ebd4..05ed705 100644
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -142,8 +142,8 @@ on:
         value: ${{ jobs.finalize.outputs.signed }}
 
 env:
-  BUILDX_VERSION: "v0.30.1"
-  BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
+  BUILDX_VERSION: "v0.31.0"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.27.0"
   SBOM_IMAGE: "docker/buildkit-syft-scanner:1.10.0"
   BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.0.4-56"
   DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.74.0"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 08dd418..da474be 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -149,8 +149,8 @@ on:
         value: ${{ jobs.finalize.outputs.signed }}
 
 env:
-  BUILDX_VERSION: "v0.30.1"
-  BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
+  BUILDX_VERSION: "v0.31.0"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.27.0"
   SBOM_IMAGE: "docker/buildkit-syft-scanner:1.10.0"
   BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.0.4-56"
   DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.74.0"