diff --git a/.github/workflows/cosign-release.yml b/.github/workflows/cosign-release.yml
index 28c1e1e..3ccc448 100644
--- a/.github/workflows/cosign-release.yml
+++ b/.github/workflows/cosign-release.yml
@@ -39,7 +39,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index 0a87995..3794087 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -43,7 +43,7 @@ jobs:
       contents: read   # required for actions/checkout on private repos
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: EndBug/label-sync@v2
         with:
           # Always pull canonical label set from the .github repo's
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 1973cd9..1da35ae 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -38,7 +38,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Generate SBOM (Go)
         if: inputs.language == 'go'