diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 6aab3f27be6..afe8da3be80 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -17,7 +17,7 @@ jobs:
           protoc --version
 
       - name: Checkout repository
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Rust versions
         run:  rustup show
diff --git a/.github/workflows/fmt-check.yml b/.github/workflows/fmt-check.yml
index 7571c51116b..8cd6a4f4db9 100644
--- a/.github/workflows/fmt-check.yml
+++ b/.github/workflows/fmt-check.yml
@@ -16,7 +16,7 @@ jobs:
     container:
       image: paritytech/ci-linux:production
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Cargo fmt
         run: cargo +nightly fmt --all -- --check
diff --git a/.github/workflows/release-01_branch-check.yml b/.github/workflows/release-01_branch-check.yml
index afcd4580f17..07310109106 100644
--- a/.github/workflows/release-01_branch-check.yml
+++ b/.github/workflows/release-01_branch-check.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release-10_rc-automation.yml b/.github/workflows/release-10_rc-automation.yml
index d1795faef09..028c7d2dd9b 100644
--- a/.github/workflows/release-10_rc-automation.yml
+++ b/.github/workflows/release-10_rc-automation.yml
@@ -17,7 +17,7 @@ jobs:
             pre-releases: true
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
       - id: compute_tag
diff --git a/.github/workflows/release-20_extrinsic-ordering-check-from-bin.yml b/.github/workflows/release-20_extrinsic-ordering-check-from-bin.yml
index d902e57ac9e..3c553f8791a 100644
--- a/.github/workflows/release-20_extrinsic-ordering-check-from-bin.yml
+++ b/.github/workflows/release-20_extrinsic-ordering-check-from-bin.yml
@@ -29,7 +29,7 @@ jobs:
       REF_URL: ${{github.event.inputs.reference_url}}
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Fetch binary
         run: |
diff --git a/.github/workflows/release-21_extrinsic-ordering-check-from-two.yml b/.github/workflows/release-21_extrinsic-ordering-check-from-two.yml
index 93c0050ff6f..63542dd1d03 100644
--- a/.github/workflows/release-21_extrinsic-ordering-check-from-two.yml
+++ b/.github/workflows/release-21_extrinsic-ordering-check-from-two.yml
@@ -42,7 +42,7 @@ jobs:
             relay: polkadot-local
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Create tmp dir
         run: |
diff --git a/.github/workflows/release-30_create-draft.yml b/.github/workflows/release-30_create-draft.yml
index 2d11dfe18ce..367a75a5141 100644
--- a/.github/workflows/release-30_create-draft.yml
+++ b/.github/workflows/release-30_create-draft.yml
@@ -68,7 +68,7 @@ jobs:
             runtime: rococo-parachain
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: ${{ github.event.inputs.ref2 }}
 
@@ -120,7 +120,7 @@ jobs:
       asset_upload_url: ${{ steps.create-release.outputs.upload_url }}
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
           path: cumulus
@@ -246,7 +246,7 @@ jobs:
             runtime: rococo-parachain
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: ${{ github.event.inputs.ref2 }}
 
diff --git a/.github/workflows/release-50_publish-docker.yml b/.github/workflows/release-50_publish-docker.yml
index 6ad943c3903..026543ea814 100644
--- a/.github/workflows/release-50_publish-docker.yml
+++ b/.github/workflows/release-50_publish-docker.yml
@@ -58,7 +58,7 @@ jobs:
 
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Prepare temp folder
         run: |
@@ -118,7 +118,7 @@ jobs:
 
     steps:
       - name: Checkout sources
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Get artifacts from cache
         uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
diff --git a/.github/workflows/srtool.yml b/.github/workflows/srtool.yml
index ae473b48137..05a43738ff7 100644
--- a/.github/workflows/srtool.yml
+++ b/.github/workflows/srtool.yml
@@ -54,7 +54,7 @@ jobs:
           - category: testing
             runtime: rococo-parachain
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0