diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml
index 66a08ca45..bf8012318 100644
--- a/.github/workflows/.test.yml
+++ b/.github/workflows/.test.yml
@@ -28,7 +28,7 @@ on:
 
 env:
   GO_VERSION: "1.21"
-  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
 
 jobs:
@@ -89,13 +89,14 @@ jobs:
             });
       -
         name: Build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c  # v6.9.0
         with:
           provenance: false
           targets: integration-tests-base
-          set: |
-            *.cache-from=type=gha,scope=${{ inputs.cache_scope }}
-            *.cache-to=type=gha,scope=${{ inputs.cache_scope }}
+          # TODO(jhorsts): replace with upstream
+          # set: |
+          #   *.cache-from=type=gha,scope=${{ inputs.cache_scope }}
+          #   *.cache-to=type=gha,scope=${{ inputs.cache_scope }}
 
   run:
     runs-on: ubuntu-22.04
@@ -129,6 +130,7 @@ jobs:
           for l in "${{ inputs.env }}"; do
             echo "${l?}" >> $GITHUB_ENV
           done
+          echo "TEST_REPORT_NAME=${{ github.job }}-$(echo "${{ matrix.pkg }}-${{ matrix.skip-integration-tests }}-${{ matrix.kind }}-${{ matrix.worker }}-${{ matrix.tags }}" | tr -dc '[:alnum:]-\n\r' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
       -
         name: Checkout
         uses: actions/checkout@v4
@@ -147,7 +149,7 @@ jobs:
           buildkitd-flags: --debug
       -
         name: Build test image
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c  # v6.9.0
         with:
           provenance: false
           targets: integration-tests
@@ -173,7 +175,8 @@ jobs:
           TEST_COVERAGE: 1
           TESTPKGS: ${{ matrix.pkg }}
           SKIP_INTEGRATION_TESTS: 1
-          CACHE_FROM: type=gha,scope=${{ inputs.cache_scope }}
+          # TODO(jhorsts): errors with HTTP 400
+          # CACHE_FROM: type=gha,scope=${{ inputs.cache_scope }}
       -
         name: Send to Codecov
         if: always()
@@ -192,7 +195,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: test-reports
+          name: test-reports-${{ env.TEST_REPORT_NAME }}
           path: ./bin/testreports
           overwrite: true
       -
diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml
index 376aa052a..7d646bb1d 100644
--- a/.github/workflows/buildkit.yml
+++ b/.github/workflows/buildkit.yml
@@ -22,7 +22,7 @@ on:
 
 env:
   GO_VERSION: "1.21"
-  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   IMAGE_NAME: "moby/buildkit"
   PLATFORMS: "linux/amd64,linux/arm/v7,linux/arm64,linux/s390x,linux/ppc64le,linux/riscv64"
@@ -125,13 +125,14 @@ jobs:
         env:
           RELEASE: ${{ startsWith(github.ref, 'refs/tags/v') }}
           PLATFORMS: ${{ matrix.platform }}
-          CACHE_FROM: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
-          CACHE_TO: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
+          # TODO(jhorsts): replace with upstream
+          # CACHE_FROM: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
+          # CACHE_TO: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
       -
         name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: buildkit
+          name: buildkit-${{ env.PLATFORM_PAIR }}
           path: ${{ env.DESTDIR }}/*
           if-no-files-found: error
 
@@ -177,8 +178,9 @@ jobs:
         env:
           RELEASE: ${{ startsWith(github.ref, 'refs/tags/v') }}
           TARGET: ${{ matrix.target-stage }}
-          CACHE_FROM: type=gha,scope=image${{ matrix.target-stage }}
-          CACHE_TO: type=gha,scope=image${{ matrix.target-stage }}
+          # TODO(jhorsts): replace with upstream
+          # CACHE_FROM: type=gha,scope=image${{ matrix.target-stage }}
+          # CACHE_TO: type=gha,scope=image${{ matrix.target-stage }}
 
   release:
     runs-on: ubuntu-22.04
@@ -190,10 +192,11 @@ jobs:
     steps:
       -
         name: Download artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0  # v5.0.0
         with:
-          name: buildkit
           path: ${{ env.DESTDIR }}
+          pattern: buildkit-*
+          merge-multiple: true
       -
         name: List artifacts
         run: |
diff --git a/.github/workflows/buildx-image.yml b/.github/workflows/buildx-image.yml
index 390965323..93e10fab6 100644
--- a/.github/workflows/buildx-image.yml
+++ b/.github/workflows/buildx-image.yml
@@ -30,7 +30,7 @@ on:
         default: 'true'
 
 env:
-  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
   REPO_SLUG_TARGET: "moby/buildkit"
 
 jobs:
diff --git a/.github/workflows/dockerd.yml b/.github/workflows/dockerd.yml
index ed913f269..6b9502968 100644
--- a/.github/workflows/dockerd.yml
+++ b/.github/workflows/dockerd.yml
@@ -10,7 +10,7 @@ on:
         default: '23.0.1'
 
 env:
-  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   TESTFLAGS: "-v --parallel=1 --timeout=30m"
 
@@ -109,7 +109,7 @@ jobs:
           buildkitd-flags: --debug
       -
         name: Download dockerd
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0  # v5.0.0
         with:
           name: dockerd
           path: ./build/
@@ -127,7 +127,8 @@ jobs:
           TESTPKGS: "${{ matrix.pkg }}"
           TESTFLAGS: "${{ env.TESTFLAGS }} --run=//worker=${{ matrix.worker }}$"
           SKIP_INTEGRATION_TESTS: "${{ matrix.skip-integration-tests }}"
-          CACHE_FROM: "type=gha,scope=build-integration-tests"
+          # TODO(jhorsts): replace with upstream
+          # CACHE_FROM: "type=gha,scope=build-integration-tests"
           BUILDKIT_INTEGRATION_DOCKERD_FLAGS: |
             --bip=10.66.66.1/24
             --default-address-pool=base=10.66.66.0/16,size=24
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index a5bef4224..5651530bf 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -20,7 +20,7 @@ on:
 
 env:
   GO_VERSION: "1.21"
-  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
   SETUP_BUILDKIT_TAG: "moby/buildkit:latest"
   IMAGE_NAME: "docker/dockerfile-upstream"
   PLATFORMS: "linux/386,linux/amd64,linux/arm/v7,linux/arm64,linux/mips,linux/mipsle,linux/mips64,linux/mips64le,linux/s390x,linux/ppc64le,linux/riscv64"
@@ -119,8 +119,9 @@ jobs:
           ./frontend/dockerfile/cmd/dockerfile-frontend/hack/release "${{ needs.prepare.outputs.typ }}" "${{ matrix.tag }}" "$IMAGE_NAME" "${{ needs.prepare.outputs.push }}"
         env:
           RELEASE: ${{ startsWith(github.ref, 'refs/tags/v') }}
-          CACHE_FROM: type=gha,scope=${{ env.CACHE_SCOPE }}
-          CACHE_TO: type=gha,scope=${{ env.CACHE_SCOPE }}
+          # TODO(jhorsts): replace with upstream
+          # CACHE_FROM: type=gha,scope=${{ env.CACHE_SCOPE }}
+          # CACHE_TO: type=gha,scope=${{ env.CACHE_SCOPE }}
 
   release:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/test-os.yml b/.github/workflows/test-os.yml
index 4dae49b6a..862a8b254 100644
--- a/.github/workflows/test-os.yml
+++ b/.github/workflows/test-os.yml
@@ -101,7 +101,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
       -
         name: Build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c  # v6.9.0
         with:
           targets: binaries
           set: |
@@ -116,6 +116,7 @@ jobs:
           retention-days: 1
 
   test-freebsd-amd64:
+    if: false  # TODO(jhorsts): Skip freebsd. Fails. Not supported by EarthBuild. Revisit after upstream merge?
     runs-on: macos-13
     needs:
       - build-freebsd-amd64
@@ -128,7 +129,7 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Download artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0  # v5.0.0
         with:
           name: buildkit-freebsd-amd64
           path: ${{ env.DESTDIR }}
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 922cb08af..243bb1e94 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -16,7 +16,7 @@ on:
   pull_request:
 
 env:
-  SETUP_BUILDX_VERSION: "latest"
+  SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
 
 jobs:
@@ -55,6 +55,6 @@ jobs:
           buildkitd-flags: --debug
       -
         name: Validate
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c  # v6.9.0
         with:
           targets: ${{ matrix.target }}
diff --git a/hack/release b/hack/release
index 0e1fe8444..0b0357c30 100755
--- a/hack/release
+++ b/hack/release
@@ -50,8 +50,9 @@ for pdir in "${output}"/*/; do
     cd "$pdir"
     releasetar=$(find . -name '*.tar.gz')
     filename=$(basename "${releasetar%.tar.gz}")
-    mv "provenance.json" "${filename}.provenance.json"
-    mv "sbom-binaries.spdx.json" "${filename}.sbom.json"
+    # TODO(jhorsts): replace with upstream
+    # mv "provenance.json" "${filename}.provenance.json"
+    # mv "sbom-binaries.spdx.json" "${filename}.sbom.json"
     find . -name 'sbom*.json' -exec rm {} \;
   )
 done