diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f86d97a..966ca7a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ jobs:
       matrix:
         node-version: [14.x]
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - uses: actions/setup-node@v2
       with:
         node-version: ${{ matrix.node-version }}
diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
index c80fad5..9e459c4 100644
--- a/.github/workflows/changes.yml
+++ b/.github/workflows/changes.yml
@@ -7,7 +7,7 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         # by default, GitHub checks out a detached head on an ephemeral pull ref. Check out the actual branch since `rush change` relies on real branches:
         repository: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/post-renovate.yml b/.github/workflows/post-renovate.yml
index f8df89a..e44a8e7 100644
--- a/.github/workflows/post-renovate.yml
+++ b/.github/workflows/post-renovate.yml
@@ -9,7 +9,7 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           token: ${{ secrets.GH_CI_TOKEN}}
       - uses: actions/setup-node@v2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6566cf9..03f1b34 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - uses: actions/setup-node@v2
       with:
         node-version: 14.x