diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index aeab739..93f8ead 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -54,8 +54,8 @@ on:
 # binfmt: pin by digest (tonistiigi/binfmt@sha256:...) for the strongest posture; the version tag
 # below is immutable enough for CI and avoids a Docker Hub token dance in the workflow.
 env:
-  BUILDX_VERSION: "0.35.0"
-  BUILDX_SHA256: "d41ece72044243b4f58b343441ae37446d9c29a7d6b5e11c61847bbcf8f7dfda"
+  BUILDX_VERSION: "0.36.1"
+  BUILDX_SHA256: "48af8a397ebd60178778bf63611dbcebe5f5e7a9be90eb9147b24b9587455778"
   BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
   TRIVY_VERSION: "0.74.0"
   TRIVY_SHA256: "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"