diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d46c0bcf330..b10a6b2e20a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v1
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index f12d8f0d011..5180cde6a07 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -15,7 +15,7 @@ jobs:
           go-version: 1.16
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
 
       - name: Cache Go modules
         uses: actions/cache@v2
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 78d94c78e5d..7b086d8ce30 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,7 +22,7 @@ jobs:
           go-version: 1.16
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
 
       - name: Verify dependencies
         run: |
diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index b95c5171537..af390a779c6 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
       - name: Set up Go 1.16
         uses: actions/setup-go@v2
         with:
@@ -38,7 +38,7 @@ jobs:
           GITHUB_CERT_PASSWORD: ${{secrets.GITHUB_CERT_PASSWORD}}
           DESKTOP_CERT_TOKEN: ${{secrets.DESKTOP_CERT_TOKEN}}
       - name: Checkout documentation site
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         with:
           repository: github/cli.github.com
           path: site
@@ -122,7 +122,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
       - name: Download gh.exe
         id: download_exe
         shell: bash
@@ -179,7 +179,7 @@ jobs:
         env:
           COMMITTER_TOKEN: ${{ secrets.UPLOAD_GITHUB_TOKEN }}
       - name: Checkout scoop bucket
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         with:
           repository: cli/scoop-gh
           path: scoop-gh