diff --git a/.github/workflows/flux-diff.yaml b/.github/workflows/flux-diff.yaml
index a8a5a3651..263b8daee 100644
--- a/.github/workflows/flux-diff.yaml
+++ b/.github/workflows/flux-diff.yaml
@@ -31,14 +31,14 @@
             private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
         - name: Checkout
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
             ref: "${{ github.event.repository.default_branch }}"
             path: default
 
         - name: Checkout Pull Request Branch
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
             path: pull
diff --git a/.github/workflows/flux-hr-sync.yaml b/.github/workflows/flux-hr-sync.yaml
index fb2a6042d..590967629 100644
--- a/.github/workflows/flux-hr-sync.yaml
+++ b/.github/workflows/flux-hr-sync.yaml
@@ -34,7 +34,7 @@
           run: brew update && brew install fluxcd/tap/flux yq
 
         - name: Checkout
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
 
diff --git a/.github/workflows/flux-image-test.yaml b/.github/workflows/flux-image-test.yaml
index 518f36b3e..abb2e28ac 100644
--- a/.github/workflows/flux-image-test.yaml
+++ b/.github/workflows/flux-image-test.yaml
@@ -36,14 +36,14 @@
           run: brew update && brew install jo yq
 
         - name: Checkout Default Branch
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
             ref: "${{ github.event.repository.default_branch }}"
             path: default
 
         - name: Checkout Pull Request Branch
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
             path: pull
diff --git a/.github/workflows/label-sync.yaml b/.github/workflows/label-sync.yaml
index f11fe0c49..72b31fedd 100644
--- a/.github/workflows/label-sync.yaml
+++ b/.github/workflows/label-sync.yaml
@@ -20,7 +20,7 @@
             private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
         - name: Checkout
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
 
diff --git a/.github/workflows/publish-terraform.yaml b/.github/workflows/publish-terraform.yaml
index acccefa6e..eb74341df 100644
--- a/.github/workflows/publish-terraform.yaml
+++ b/.github/workflows/publish-terraform.yaml
@@ -32,7 +32,7 @@
           run: brew update && brew install fluxcd/tap/flux
 
         - name: Checkout
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"
 
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index fcc3aa3cb..30a9a22e2 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -53,7 +53,7 @@
             private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
         - name: Checkout
-          uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             token: "${{ steps.app-token.outputs.token }}"