diff --git a/.github/workflows/digestabot.yaml b/.github/workflows/digestabot.yaml
index 96cf032d..eac45ce5 100644
--- a/.github/workflows/digestabot.yaml
+++ b/.github/workflows/digestabot.yaml
@@ -16,7 +16,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: chainguard-dev/actions/digesta-bot@main
         with:
           token: ${{ secrets.DIGEST_BOT_CHAINGUARD_DEV_PAT }}
diff --git a/.github/workflows/mega-module.yaml b/.github/workflows/mega-module.yaml
index 9999ddbe..ec6e6613 100644
--- a/.github/workflows/mega-module.yaml
+++ b/.github/workflows/mega-module.yaml
@@ -50,7 +50,7 @@ jobs:
       with:
         go-version: '1.20'
 
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+    - uses: actions/checkout@v4 # v3.1.0
       with:
         path: tf-apko
 
@@ -61,7 +61,7 @@ jobs:
     - uses: sigstore/cosign-installer@v3.1.1
     - uses: imjasonh/setup-crane@v0.3
 
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+    - uses: actions/checkout@v4 # v3.1.0
       with:
         repository: chainguard-images/images
         path: images
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 47afb961..e4572414 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: git fetch --prune --unshallow
       - uses: actions/setup-go@v4
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5efa1adc..ddc8371a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,7 +9,7 @@ jobs:
   generate:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-go@v4
       with:
         go-version: '1.20'
@@ -31,7 +31,7 @@ jobs:
         - '1.1.*'
         - '1.0.*'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-go@v4
       with:
         go-version: '1.20'