diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ac579053..1bdcb160 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -55,12 +55,12 @@ jobs:
     steps:
       - id: pr-checkout
         if: startsWith( needs.pre-deployment.outputs.branch, 'pull/' ) && endsWith( needs.pre-deployment.outputs.branch, '/merge' )
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: refs/${{ env.BRANCH }}
 
       - if: steps.pr-checkout.conclusion == 'skipped'
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ env.BRANCH }}
 
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 9cd45294..385f2923 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -33,7 +33,7 @@ jobs:
       BINARY_NAME: ${{ steps.meta.outputs.BINARY_NAME }}
       PUSH: ${{ github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch }}
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - id: meta
         run: |
           echo "BINARY_NAME=$(cargo metadata --offline --no-deps --format-version=1 | jq -r '.packages[].targets[] | select(.kind | map(. == "bin") | any ) | .name')" >> $GITHUB_OUTPUT
@@ -80,7 +80,7 @@ jobs:
         if: matrix.platform.target == 'x86_64-unknown-linux-musl'
         run: |
           sudo apt-get install -y musl-tools --no-install-recommends
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           filter: tree:0
           fetch-depth: 0
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index 4c937658..0967f06e 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions: {}
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           filter: tree:0
           fetch-depth: 0
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 5d918bb6..cd4d7bd9 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -157,7 +157,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # You have to check out your repo first.
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: ""
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index cc35fcdd..3b507f7d 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -46,7 +46,7 @@ jobs:
         continue-on-error: true
 
       - name: "Checkout ${{ env.config_file }}"
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: |
             ${{ env.config_file }}