diff --git a/.github/workflows/ci-build-binary-artifacts.yaml b/.github/workflows/ci-build-binary-artifacts.yaml
index e45e2ed4..d526063b 100644
--- a/.github/workflows/ci-build-binary-artifacts.yaml
+++ b/.github/workflows/ci-build-binary-artifacts.yaml
@@ -50,15 +50,15 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
 
       - name: Package Pulsar source
         run: build-support/generate-source-archive.sh
 
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - name: Build dependencies Docker image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: ./pkg/${{matrix.pkg.type}}
           load: true
diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index d209b533..21c9a167 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -357,15 +357,15 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
 
       - name: Package Pulsar source
         run: build-support/generate-source-archive.sh
 
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - name: Build dependencies Docker image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: ./pkg/${{matrix.pkg.type}}
           load: true
diff --git a/pkg/apk/APKBUILD b/pkg/apk/APKBUILD
index 85bb1bae..464fecc6 100644
--- a/pkg/apk/APKBUILD
+++ b/pkg/apk/APKBUILD
@@ -41,6 +41,11 @@ build() {
     git clone https://github.com/microsoft/vcpkg.git
     mv vcpkg $ROOT_DIR/
     export VCPKG_FORCE_SYSTEM_BINARIES=1
+    # On aarch64 musl, vcpkg has no prebuilt binary and builds from source.
+    # The default bootstrap downloads old curl 7.29.0 headers that lack
+    # target-independent curlbuild.h, failing on aarch64. Use system curl instead.
+    sed -i 's/-DCMAKE_BUILD_TYPE=Release/-DVCPKG_LIBCURL_DLSYM=OFF -DCMAKE_BUILD_TYPE=Release/' \
+        $ROOT_DIR/vcpkg/scripts/bootstrap.sh
     set +e
     cmake -B build -DINTEGRATE_VCPKG=ON -DCMAKE_BUILD_TYPE=Release \
         -DCMAKE_MAKE_PROGRAM=make \
diff --git a/pkg/apk/Dockerfile b/pkg/apk/Dockerfile
index 1335174b..721a07d5 100644
--- a/pkg/apk/Dockerfile
+++ b/pkg/apk/Dockerfile
@@ -28,6 +28,7 @@ RUN apk add \
       abuild \
       bash \
       curl \
+      curl-dev \
       g++ \
       make \
       cmake \