diff --git a/hack/scripts/setup-buildx-amd64-arm64 b/hack/scripts/setup-buildx-amd64-arm64
index f52a614..b1228ec 100755
--- a/hack/scripts/setup-buildx-amd64-arm64
+++ b/hack/scripts/setup-buildx-amd64-arm64
@@ -3,7 +3,7 @@
 set -eou pipefail
 
 # renovate: datasource=github-releases depName=moby/buildkit
-BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.12.2"
+BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.12.3"
 
 docker buildx create --driver docker-container --platform linux/amd64 --name xbuild --use --driver-opt image=${BUILDKIT_IMAGE} --config /usr/local/bin/buildkit.toml
 docker buildx create --append --name xbuild --platform linux/arm64 tcp://docker-arm64.ci.svc:2376 --driver-opt image=${BUILDKIT_IMAGE} --config /usr/local/bin/buildkit.toml
diff --git a/hack/scripts/setup-ci b/hack/scripts/setup-ci
index cbb35e4..7aef496 100755
--- a/hack/scripts/setup-ci
+++ b/hack/scripts/setup-ci
@@ -5,7 +5,7 @@ set -ex
 export TAG=$(git log --oneline --format=%B -n 1 HEAD | head -n 1 | sed -r "/^release\(/ s/^release\((.*)\):.*$/\\1/; t; Q")
 
 # renovate: datasource=github-releases depName=moby/buildkit
-BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.12.2"
+BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.12.3"
 
 # setup buildkit across amd64/arm64 workers
 function setup_buildkit() {