diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ef5aa484..b619704c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
           - "3.12"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.7
+      - uses: actions/checkout@v4.2.0
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d73bf613..e543f763 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.7 # v3.3.0
+      - uses: actions/checkout@v4.2.0 # v3.3.0
 
       - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 1ef60e21..abc7a6da 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.7
+      - uses: actions/checkout@v4.2.0
 
       - uses: actions/setup-python@v5
         with:
@@ -24,7 +24,7 @@ jobs:
   check-readme:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.7
+      - uses: actions/checkout@v4.2.0
 
       - uses: actions/setup-python@v5
         # NOTE(ww): Important: use pip-audit's minimum supported Python version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ca3d5c6..ea45301e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4.1.7
+    - uses: actions/checkout@v4.2.0
 
     - uses: actions/setup-python@v5
       with:
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index b18709cc..0f46ab93 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -22,7 +22,7 @@ jobs:
     
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4.1.7 # tag=v3.0.0
+        uses: actions/checkout@v4.2.0 # tag=v3.0.0
         with:
           persist-credentials: false