diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index 14fe15e225a..252f5aea3a2 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
 
       # FIXME: setup-qemu-action is depended by `gomodjail pack`
       - name: Set up QEMU
diff --git a/.github/workflows/job-build.yml b/.github/workflows/job-build.yml
index c1b2700ea31..938bfd7b351 100644
--- a/.github/workflows/job-build.yml
+++ b/.github/workflows/job-build.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-lint-go.yml b/.github/workflows/job-lint-go.yml
index b4eac0e4668..1b5442a698b 100644
--- a/.github/workflows/job-lint-go.yml
+++ b/.github/workflows/job-lint-go.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-lint-other.yml b/.github/workflows/job-lint-other.yml
index 2f012789877..509f2bbf950 100644
--- a/.github/workflows/job-lint-other.yml
+++ b/.github/workflows/job-lint-other.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-lint-project.yml b/.github/workflows/job-lint-project.yml
index a3c840642a5..dbf6d8f3912 100644
--- a/.github/workflows/job-lint-project.yml
+++ b/.github/workflows/job-lint-project.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 100
           path: src/github.com/containerd/nerdctl
diff --git a/.github/workflows/job-test-dependencies.yml b/.github/workflows/job-test-dependencies.yml
index 625dca61fa8..9a025c1ac27 100644
--- a/.github/workflows/job-test-dependencies.yml
+++ b/.github/workflows/job-test-dependencies.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index 32a0088822d..da776b86db5 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
index da6822bb5f3..932a070e00d 100644
--- a/.github/workflows/job-test-in-host.yml
+++ b/.github/workflows/job-test-in-host.yml
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-lima.yml b/.github/workflows/job-test-in-lima.yml
index 8a7567cb120..33201d7e5e3 100644
--- a/.github/workflows/job-test-in-lima.yml
+++ b/.github/workflows/job-test-in-lima.yml
@@ -26,7 +26,7 @@ jobs:
       TARGET: ${{ inputs.target }}
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-vagrant.yml b/.github/workflows/job-test-in-vagrant.yml
index 2c12637326e..630a870183a 100644
--- a/.github/workflows/job-test-in-vagrant.yml
+++ b/.github/workflows/job-test-in-vagrant.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: "${{ inputs.runner }}"
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
index c7af9804e75..e892876eea9 100644
--- a/.github/workflows/job-test-unit.yml
+++ b/.github/workflows/job-test-unit.yml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55cf55111f3..7501eaed669 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
       id-token: write  # for provenances
       attestations: write  # for provenances
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     # FIXME: setup-qemu-action is depended by `gomodjail pack`
     - name: "Set up QEMU"
       uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
diff --git a/.github/workflows/workflow-flaky.yml b/.github/workflows/workflow-flaky.yml
index 85b5c1dd650..9851047f308 100644
--- a/.github/workflows/workflow-flaky.yml
+++ b/.github/workflows/workflow-flaky.yml
@@ -45,7 +45,7 @@ jobs:
       ROOTFUL: true
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 1
       - name: "Run"
diff --git a/.github/workflows/workflow-tigron.yml b/.github/workflows/workflow-tigron.yml
index e74b34a9082..7be9d65ac86 100644
--- a/.github/workflows/workflow-tigron.yml
+++ b/.github/workflows/workflow-tigron.yml
@@ -32,7 +32,7 @@ jobs:
             canary: go-canary
     steps:
       - name: "Checkout project"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
         with:
           fetch-depth: 100
       - if: ${{ matrix.canary }}