diff --git a/.github/workflows/daily.wikiman.yml b/.github/workflows/daily.wikiman.yml
index 645945ecf..d13ffae8e 100644
--- a/.github/workflows/daily.wikiman.yml
+++ b/.github/workflows/daily.wikiman.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
       - name: copy pacman.yaml
         run: cp pacman.yaml current-pacman.yaml
       - name: write GH action token to file
diff --git a/.github/workflows/docker.build.yml b/.github/workflows/docker.build.yml
index ce0696011..b587249d5 100644
--- a/.github/workflows/docker.build.yml
+++ b/.github/workflows/docker.build.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
       -
         name: Docker meta
         id: docker_meta
@@ -67,14 +67,14 @@ jobs:
       -
         name: Check out `wmde/wbaas-deploy` repository in staging child directory
         if: steps.update-check.outputs.match == 'true'
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
         with:
           repository: wmde/wbaas-deploy
           path: ./repos/wbaas-deploy-staging
       -
         name: Check out `wmde/wbaas-deploy` repository in production child directory
         if: steps.update-check.outputs.match == 'true'
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
         with:
           repository: wmde/wbaas-deploy
           path: ./repos/wbaas-deploy-production
diff --git a/.github/workflows/docker.lint.yml b/.github/workflows/docker.lint.yml
index a34a2f4da..954cb31a1 100644
--- a/.github/workflows/docker.lint.yml
+++ b/.github/workflows/docker.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
       - name: lint
         uses: hadolint/hadolint-action@v2.1.0
         with:
diff --git a/.github/workflows/github.prs.combine.yml b/.github/workflows/github.prs.combine.yml
index 1006e4acc..1ea5b8154 100644
--- a/.github/workflows/github.prs.combine.yml
+++ b/.github/workflows/github.prs.combine.yml
@@ -93,7 +93,7 @@ jobs:
             console.log('Combined: ' + combined);
             return combined
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@v4.0.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_TOKEN_PLUSW }}
diff --git a/.github/workflows/mediawiki.verify.yml b/.github/workflows/mediawiki.verify.yml
index ddae8d9ad..3311980da 100644
--- a/.github/workflows/mediawiki.verify.yml
+++ b/.github/workflows/mediawiki.verify.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
       - name: build docker
         run: docker-compose up -d
       - name: Wait for server to accept connections
diff --git a/.github/workflows/wbstack.php.lint.yml b/.github/workflows/wbstack.php.lint.yml
index 304648a5d..4f359d2c4 100644
--- a/.github/workflows/wbstack.php.lint.yml
+++ b/.github/workflows/wbstack.php.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
 
       - uses: shivammathur/setup-php@v2
         with:
diff --git a/.github/workflows/wbstack.python.lint.yml b/.github/workflows/wbstack.python.lint.yml
index ab7f066ee..b649926c2 100644
--- a/.github/workflows/wbstack.python.lint.yml
+++ b/.github/workflows/wbstack.python.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
 
       - name: Set up Python 3.7
         uses: actions/setup-python@v4
diff --git a/.github/workflows/wbstack.sync.check.yml b/.github/workflows/wbstack.sync.check.yml
index 244ec7293..62f814041 100644
--- a/.github/workflows/wbstack.sync.check.yml
+++ b/.github/workflows/wbstack.sync.check.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
       - name: run sync
         run: ./sync.sh
       - name: Show `git diff`` output
diff --git a/.github/workflows/wbstack.sync.trigger.yml b/.github/workflows/wbstack.sync.trigger.yml
index ab642f1fe..7b6e0b913 100644
--- a/.github/workflows/wbstack.sync.trigger.yml
+++ b/.github/workflows/wbstack.sync.trigger.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4.0.0
         with:
           ref: ${{ github.event.inputs.branch }}
       - name: run sync
diff --git a/.github/workflows/wbstack.yaml.lint.yml b/.github/workflows/wbstack.yaml.lint.yml
index d6109e041..cb1417780 100644
--- a/.github/workflows/wbstack.yaml.lint.yml
+++ b/.github/workflows/wbstack.yaml.lint.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@v4.0.0
 
       - name: yamllint
         uses: ibiqlik/action-yamllint@v3
diff --git a/.github/workflows/wikiman.validate.yml b/.github/workflows/wikiman.validate.yml
index 99410ae07..6afea3ddd 100644
--- a/.github/workflows/wikiman.validate.yml
+++ b/.github/workflows/wikiman.validate.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@v4.0.0
 
       - uses: actions/setup-node@v3