diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 048b6cd..9184180 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -7,7 +7,7 @@ jobs:
   full-gate:
     runs-on: docker-host
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0 # ci.sh's docs-only check needs history; checkout defaults to depth 1
       - run: bash ci.sh
diff --git a/.gitea/workflows/mirror.yml b/.gitea/workflows/mirror.yml
index 9a4a084..0cbee3f 100644
--- a/.gitea/workflows/mirror.yml
+++ b/.gitea/workflows/mirror.yml
@@ -9,7 +9,7 @@ jobs:
   github-mirror:
     runs-on: docker-host
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
       - run: |
diff --git a/.gitea/workflows/registry-cleanup.yml b/.gitea/workflows/registry-cleanup.yml
index 2dae8e8..700c2e5 100644
--- a/.gitea/workflows/registry-cleanup.yml
+++ b/.gitea/workflows/registry-cleanup.yml
@@ -8,7 +8,7 @@ jobs:
   prune-stale-images:
     runs-on: docker-host
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v4.4.0
       - name: Delete hash images that are neither release-tagged nor a branch head
         env:
           REGISTRY_TOKEN: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 4468563..b3fa60e 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -7,7 +7,7 @@ jobs:
   retag-image:
     runs-on: docker-host
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v4.4.0
       - name: Promote the commit-hash image to semver + latest
         env:
           GIT_TAG: ${{ github.ref_name }}
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 511fb0b..fa13e80 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: docker-host
     needs: renovate
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
       - name: Tag a release for what Renovate merged