diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1282b3eb..52dee9b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
           - "3.12"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.1
+      - uses: actions/checkout@v4.2.2
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1fdead42..3779a536 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.1 # v3.3.0
+      - uses: actions/checkout@v4.2.2 # v3.3.0
 
       - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 16ed1b8a..cdc84dad 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.1
+      - uses: actions/checkout@v4.2.2
 
       - uses: actions/setup-python@v5
         with:
@@ -24,7 +24,7 @@ jobs:
   check-readme:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.1
+      - uses: actions/checkout@v4.2.2
 
       - uses: actions/setup-python@v5
         # NOTE(ww): Important: use pip-audit's minimum supported Python version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2df588b7..b1925768 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4.2.1
+    - uses: actions/checkout@v4.2.2
 
     - uses: actions/setup-python@v5
       with:
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index c5c08138..7b1ee0a9 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -22,7 +22,7 @@ jobs:
     
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4.2.1 # tag=v3.0.0
+        uses: actions/checkout@v4.2.2 # tag=v3.0.0
         with:
           persist-credentials: false