diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5c482d..ec79dca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
           install: true
 
       - name: Build Docker image and store in cache
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           push: false
diff --git a/Dockerfile b/Dockerfile
index b3ddf5e..1bbd9bd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,9 @@ FROM ${WOLFI_BASE} AS builder
 
 # build-base bundles gcc/g++, make and glibc-dev (for the C++ side
 # of Factor's VM); the rest fetch + bootstrap the source tree.
-RUN apk add --no-cache bash build-base curl git wget
+# gcc / libstdc++-dev are held at the last 15.x release
+RUN apk add --no-cache bash build-base curl git wget \
+    gcc=15.2.0-r11 libstdc++-dev=15.2.0-r11
 
 # Factor 0.101
 ARG FACTOR_COMMIT="a56e6390e81340be6573cb790311c0a980a5f369"