diff --git a/.github/workflows/autotools-cmake.yml b/.github/workflows/autotools-cmake.yml
index 1f1fa6d5..060518ad 100644
--- a/.github/workflows/autotools-cmake.yml
+++ b/.github/workflows/autotools-cmake.yml
@@ -61,7 +61,7 @@ jobs:
         shell: bash
     runs-on: "${{ matrix.os }}"
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: (Linux) Install build dependencies
       if: "${{ runner.os == 'Linux' }}"
diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index 83974417..ebee2512 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -45,7 +45,7 @@ jobs:
     name: Enforce clang-format clean code
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Install clang-format 19
       run: |-
diff --git a/.github/workflows/clang-tidy.yml b/.github/workflows/clang-tidy.yml
index 7a81686d..2db4dac0 100644
--- a/.github/workflows/clang-tidy.yml
+++ b/.github/workflows/clang-tidy.yml
@@ -45,7 +45,7 @@ jobs:
     name: Enforce clang-tidy clean code
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Install clang-tidy 19
       run: |-
diff --git a/.github/workflows/cmake-required-version.yml b/.github/workflows/cmake-required-version.yml
index d37ac889..c122c92a 100644
--- a/.github/workflows/cmake-required-version.yml
+++ b/.github/workflows/cmake-required-version.yml
@@ -46,7 +46,7 @@ jobs:
     name: Ensure realistic minimum CMake version requirement
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Install ancient CMake
       run: |
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index db8c68e5..aed97590 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -45,7 +45,7 @@ jobs:
     name: Enforce codespell-clean spelling
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630  # v2.1
       with:
         path: expat/
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index c9759f09..d2699060 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -48,7 +48,7 @@ jobs:
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Install build dependencies
       run: |-
         set -x -u
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index e2587187..daa51053 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -46,7 +46,7 @@ jobs:
     name: Run Cppcheck
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Install runtime dependencies
       run: |
         exec brew install cppcheck
diff --git a/.github/workflows/expat_config_h.yml b/.github/workflows/expat_config_h.yml
index facdfa32..566b22fa 100644
--- a/.github/workflows/expat_config_h.yml
+++ b/.github/workflows/expat_config_h.yml
@@ -45,7 +45,7 @@ jobs:
     name: Check expat_config.h.{in,cmake} for regressions
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Check expat_config.h.{in,cmake} for regressions
       run: |
         set -v
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index b01c3d7c..9e430c70 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -44,7 +44,7 @@ jobs:
     name: Run fuzzing regression tests
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Install Clang 19
       run: |-
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index c05d2612..58989fad 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -88,7 +88,7 @@ jobs:
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Install build dependencies (MinGW)
       if: "${{ contains(matrix.FLAT_ENV, 'mingw') }}"
       run: |-
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 781f5f82..28a44656 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -54,7 +54,7 @@ jobs:
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Install build dependencies
       run: |
         sudo rm /usr/local/bin/2to3  # so that "brew link" will work
diff --git a/.github/workflows/valid-xml.yml b/.github/workflows/valid-xml.yml
index bb5e39ef..21c8aa5e 100644
--- a/.github/workflows/valid-xml.yml
+++ b/.github/workflows/valid-xml.yml
@@ -45,7 +45,7 @@ jobs:
     name: Ensure well-formed and valid XML
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Install build dependencies
       run: |-