diff --git a/.github/workflows/auto-approve-deps.yml b/.github/workflows/auto-approve-deps.yml
index bb711dafe..ee4b0fd86 100644
--- a/.github/workflows/auto-approve-deps.yml
+++ b/.github/workflows/auto-approve-deps.yml
@@ -13,7 +13,7 @@ jobs:
       - name: Fetch and confirm dependabot metadata
         id: dependabot-metadata
         uses: dependabot/fetch-metadata@v1.6.0
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.0.0
       - name: Approve a PR if not already approved
         run: |
           gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status`
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index eeb77e534..068d6e07f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@v4.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/lint-pr-title-body.yml b/.github/workflows/lint-pr-title-body.yml
index 8ef8a1038..5630aa4bf 100644
--- a/.github/workflows/lint-pr-title-body.yml
+++ b/.github/workflows/lint-pr-title-body.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.0.0
       - name: Use Node.js 16
         uses: actions/setup-node@v3.8.1
         with:
diff --git a/.github/workflows/presubmit.yml b/.github/workflows/presubmit.yml
index c82a1128f..6e552e091 100644
--- a/.github/workflows/presubmit.yml
+++ b/.github/workflows/presubmit.yml
@@ -20,9 +20,9 @@ jobs:
       Editable: github.event_name == 'pull_request_target' || github.event_name == 'workflow_dispatch'
 
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.0.0
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.0.0
         if: github.event_name == 'pull_request_target'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 76462f40d..f061393c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@v4.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/scan-deps.yml b/.github/workflows/scan-deps.yml
index 9731252d4..4ee69f8c9 100644
--- a/.github/workflows/scan-deps.yml
+++ b/.github/workflows/scan-deps.yml
@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@v4.0.0
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v3
diff --git a/.github/workflows/update-dicts.yml b/.github/workflows/update-dicts.yml
index b6380375c..bd587ae92 100644
--- a/.github/workflows/update-dicts.yml
+++ b/.github/workflows/update-dicts.yml
@@ -8,7 +8,7 @@ jobs:
   update-dicts:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.0.0
       - uses: actions/setup-node@v3.8.1
         with:
           node-version: '16'