diff --git a/.github/workflows/repro.yaml b/.github/workflows/repro.yaml
index 668e20f..2c6b653 100644
--- a/.github/workflows/repro.yaml
+++ b/.github/workflows/repro.yaml
@@ -14,11 +14,11 @@ jobs:
       attestations: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Checkout submodules
         run: git submodule update --init --recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v4
       - name: Compute original checksum
         run: sha256sum taglib.wasm > taglib.wasm.sum
       - name: Build taglib.wasm
@@ -29,7 +29,7 @@ jobs:
         run: |
           sha256sum -c taglib.wasm.sum || exit 1
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: |
             taglib.wasm
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 2abc0e4..2a27aa2 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -10,13 +10,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v5
         with:
           go-version-file: go.mod
       - name: Lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
           install-mode: goinstall
           version: v2.4.0
diff --git a/build/Dockerfile b/build/Dockerfile
index 6f7d69f..91d4b73 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/webassembly/wasi-sdk:wasi-sdk-27
+FROM ghcr.io/webassembly/wasi-sdk:wasi-sdk-32
 
 RUN apt-get update && \
 	apt-get install -y --no-install-recommends curl && \