diff --git a/.github/workflows/docker-release.yaml b/.github/workflows/docker-release.yaml
index 63ae008..f1f131a 100644
--- a/.github/workflows/docker-release.yaml
+++ b/.github/workflows/docker-release.yaml
@@ -108,8 +108,19 @@ on:
 env:
   IMAGE_NAME: ${{ github.repository_owner }}/${{ inputs.image-name }}
   REGISTRY: ghcr.io
+  # Held one patch behind on purpose. setup-buildx-action resolves the version
+  # to download from docker/actions-toolkit's .github/buildx-releases.json,
+  # which is regenerated by a bot AFTER each buildx release, so a pin bumped
+  # the same day fails every docker release in the fleet with "Cannot find
+  # Buildx release <v> in releases JSON". v0.36.1 published 2026-08-04 15:50Z,
+  # Renovate landed it 16:02Z, and the JSON still did not carry it 7 hours
+  # later. The durable guard is a minimumReleaseAge for docker/buildx in the
+  # shared preset (cplieger/.github default.json), which holds the bump until
+  # the JSON has caught up; this value only needs to move when that PR opens.
+  # Note ci.yaml's build-ability job passes NO version input and so never
+  # broke — which is why every PR stayed green while every release died.
   # renovate: datasource=github-releases depName=docker/buildx
-  BUILDX_VERSION: v0.36.1
+  BUILDX_VERSION: v0.36.0
   # A cosign MAJOR is a breaking change even when the bump looks routine
   # (v2→v3 flipped sign-blob defaults and broke release SBOM signing) — majors
   # are not auto-merged; read the changelog before approving.