diff --git a/.github/workflows/CI.yaml b/.github/workflows/CI.yaml
index f768792..a7b6193 100644
--- a/.github/workflows/CI.yaml
+++ b/.github/workflows/CI.yaml
@@ -84,7 +84,10 @@ jobs:
         run: make build -j3
 
       - name: Build Docker images
-        run: make docker
+        # Retry once: booting buildkit pulls moby/buildkit from Docker Hub, which
+        # intermittently times out on shared runners. Mirrors publish-docker.yaml's
+        # `make docker.push || make docker.push`.
+        run: make docker || make docker
 
 
   command-tests:
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index 3030c85..e72414a 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -45,7 +45,7 @@ jobs:
         with:
           go-version: "1.26"
       - name: Log in to the Container registry
-        uses: docker/login-action@v1.10.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ${{ env.HUB }}
           username: ${{ github.actor }}