diff --git a/.github/workflows/autotools-cmake.yml b/.github/workflows/autotools-cmake.yml
index 5c74077d..9dcd329b 100644
--- a/.github/workflows/autotools-cmake.yml
+++ b/.github/workflows/autotools-cmake.yml
@@ -58,7 +58,7 @@ jobs:
         shell: bash
     runs-on: "${{ matrix.os }}"
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
 
     - name: (Linux) Install build dependencies
       if: "${{ runner.os == 'Linux' }}"
diff --git a/.github/workflows/cmake-required-version.yml b/.github/workflows/cmake-required-version.yml
index c0e884eb..6f31661b 100644
--- a/.github/workflows/cmake-required-version.yml
+++ b/.github/workflows/cmake-required-version.yml
@@ -43,7 +43,7 @@ jobs:
     name: Ensure realistic minimum CMake version requirement
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
 
     - name: Install ancient CMake
       run: |
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 485ede72..7267e994 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -43,7 +43,7 @@ jobs:
     name: Enforce codespell-clean spelling
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
     - uses: codespell-project/actions-codespell@94259cd8be02ad2903ba34a22d9c13de21a74461  # v2.0
       with:
         path: expat/
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 48090d2d..3d240b25 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -45,7 +45,7 @@ jobs:
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
     - name: Install build dependencies
       run: |-
         set -x -u
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index d84fbb54..808e6166 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -43,7 +43,7 @@ jobs:
     name: Run Cppcheck
     runs-on: macos-11
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
     - name: Install runtime dependencies
       run: |
         exec brew install cppcheck findutils
diff --git a/.github/workflows/expat_config_h.yml b/.github/workflows/expat_config_h.yml
index f61f2ea9..cb80d1a0 100644
--- a/.github/workflows/expat_config_h.yml
+++ b/.github/workflows/expat_config_h.yml
@@ -43,7 +43,7 @@ jobs:
     name: Check expat_config.h.{in,cmake} for regressions
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
     - name: Check expat_config.h.{in,cmake} for regressions
       run: |
         set -v
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 8f4c2228..d49189f7 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -83,7 +83,7 @@ jobs:
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
     - name: Install build dependencies (MinGW)
       if: "${{ contains(matrix.FLAT_ENV, 'mingw') }}"
       run: |-
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index e2396d0d..d2bb3e4d 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -53,7 +53,7 @@ jobs:
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address
     runs-on: macos-11
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
     - name: Install build dependencies
       run: |
         sudo rm /usr/local/bin/2to3  # so that "brew link" will work
diff --git a/.github/workflows/valid-xml.yml b/.github/workflows/valid-xml.yml
index 0e25e406..85ae39d4 100644
--- a/.github/workflows/valid-xml.yml
+++ b/.github/workflows/valid-xml.yml
@@ -43,7 +43,7 @@ jobs:
     name: Ensure well-formed and valid XML
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac  # v4.0.0
 
     - name: Install build dependencies
       run: |-