diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 756731c..8a4c465 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -30,9 +30,9 @@ jobs:
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup Release Please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@v5
         id: release
         with:
           token: ${{ secrets.CR_PAT }}
diff --git a/.github/workflows/repro.yaml b/.github/workflows/repro.yaml
index 668e20f..2c6b653 100644
--- a/.github/workflows/repro.yaml
+++ b/.github/workflows/repro.yaml
@@ -14,11 +14,11 @@ jobs:
       attestations: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Checkout submodules
         run: git submodule update --init --recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v4
       - name: Compute original checksum
         run: sha256sum taglib.wasm > taglib.wasm.sum
       - name: Build taglib.wasm
@@ -29,7 +29,7 @@ jobs:
         run: |
           sha256sum -c taglib.wasm.sum || exit 1
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: |
             taglib.wasm
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index b68ddeb..924cdea 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -10,13 +10,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
       - name: Lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
           install-mode: goinstall
           version: v2.6.1
diff --git a/build/Dockerfile b/build/Dockerfile
index 6f7d69f..0e3a479 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/webassembly/wasi-sdk:wasi-sdk-27
+FROM ghcr.io/webassembly/wasi-sdk:wasi-sdk-33
 
 RUN apt-get update && \
 	apt-get install -y --no-install-recommends curl && \