diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 61da0ab7d..dd8f1e6a8 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,7 +34,7 @@ jobs:
           - "e2e/smoke"
           - "e2e/write_source_files"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: bazel-contrib/setup-bazel@0.15.0
         with:
           bazelisk-cache: true
@@ -53,7 +53,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: pre-commit/action@v3.0.1
       - name: Verify BCR patches
         run: patch --dry-run -p1 --fuzz 0 < .bcr/patches/*.patch
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 276d3b29e..83079a5cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
     # Go cross-compilation works from linux -> any platform
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build Go Binaries
         env:
           # NB: this variable is read by tools/release/copy_release_artifacts.sh
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 67a4bedcf..b373bbc49 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -25,7 +25,7 @@ jobs:
       new-tag: ${{ steps.ccv.outputs.new-tag }}
       new-tag-version: ${{steps.ccv.outputs.new-tag-version}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # Need enough history to find the prior release tag
           fetch-depth: 0