diff --git a/.github/workflows/browser-tests.js.yml b/.github/workflows/browser-tests.js.yml
index 1528957e..f930c1b2 100644
--- a/.github/workflows/browser-tests.js.yml
+++ b/.github/workflows/browser-tests.js.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4.1.6
+      - uses: actions/checkout@v4.2.2
         with:
           repository: wbstack/api
           path: api
@@ -29,7 +29,7 @@ jobs:
       - run: docker compose exec api bash -c 'php artisan migrate:fresh && php artisan passport:install && php artisan db:seed && php artisan key:generate && php artisan storage:link'
         working-directory: api
 
-      - uses: actions/checkout@v4.1.6
+      - uses: actions/checkout@v4.2.2
         with:
           path: ui
 
diff --git a/.github/workflows/docker.build.yml b/.github/workflows/docker.build.yml
index a9c4cdf0..d2f2edfd 100644
--- a/.github/workflows/docker.build.yml
+++ b/.github/workflows/docker.build.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.5.3
+        uses: actions/checkout@v4.2.2
       - name: Docker meta
         id: docker_meta
         uses: crazy-max/ghaction-docker-meta@v4.6.0
@@ -51,13 +51,13 @@ jobs:
           labels: ${{ steps.docker_meta.outputs.labels }}
       - name: Check out `wmde/wbaas-deploy` repository in staging child directory
         if: github.event_name != 'pull_request'
-        uses: actions/checkout@v3.5.3
+        uses: actions/checkout@v4.2.2
         with:
           repository: wmde/wbaas-deploy
           path: ./repos/wbaas-deploy-staging
       - name: Check out `wmde/wbaas-deploy` repository in production child directory
         if: github.event_name != 'pull_request'
-        uses: actions/checkout@v3.5.3
+        uses: actions/checkout@v4.2.2
         with:
           repository: wmde/wbaas-deploy
           path: ./repos/wbaas-deploy-production
diff --git a/.github/workflows/docker.lint.yml b/.github/workflows/docker.lint.yml
index d8807e9d..82bd5d29 100644
--- a/.github/workflows/docker.lint.yml
+++ b/.github/workflows/docker.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps: 
     - name: Checkout
-      uses: actions/checkout@v3.5.3
+      uses: actions/checkout@v4.2.2
     - name: lint
       uses: hadolint/hadolint-action@v3.1.0
       with:
diff --git a/.github/workflows/github.prs.combine.yml b/.github/workflows/github.prs.combine.yml
index af3491e9..80f8cbc4 100644
--- a/.github/workflows/github.prs.combine.yml
+++ b/.github/workflows/github.prs.combine.yml
@@ -93,7 +93,7 @@ jobs:
             console.log('Combined: ' + combined);
             return combined
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3.5.3
+      - uses: actions/checkout@v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_TOKEN_PLUSW }}
diff --git a/.github/workflows/netlify-preview.yml b/.github/workflows/netlify-preview.yml
index a3b360a7..471db86c 100644
--- a/.github/workflows/netlify-preview.yml
+++ b/.github/workflows/netlify-preview.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v3.5.3
+    - uses: actions/checkout@v4.2.2
 
     - uses: c-py/action-dotenv-to-setenv@v4
       with:
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v3.5.3
+    - uses: actions/checkout@v4.2.2
 
     - uses: c-py/action-dotenv-to-setenv@v4
       with:
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index 273ab4d2..063234b0 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -19,7 +19,7 @@ jobs:
         node-version: [22]
 
     steps:
-    - uses: actions/checkout@v3.5.3
+    - uses: actions/checkout@v4.2.2
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v4.0.3
       with: