diff --git a/.github/workflows/buildifier.yaml b/.github/workflows/buildifier.yaml
index f173f2b..ac548ca 100644
--- a/.github/workflows/buildifier.yaml
+++ b/.github/workflows/buildifier.yaml
@@ -12,6 +12,6 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: buildifier
         run: bazel run --enable_bzlmod //.github/workflows:buildifier.check
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f3c4581..3f86c73 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -29,7 +29,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pre-commit/action@v3.0.1
   # For branch protection settings, this job provides a "stable" name that can be used to gate PR merges
   # on "all matrix jobs were successful".
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index e1a54a6..d99d56d 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -22,7 +22,7 @@ jobs:
       new-tag-version-type: ${{steps.ccv.outputs.new-tag-version-type}}
       recently-tagged: ${{steps.recent-tag.outputs.recently-tagged}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # Need enough history to find the prior release tag
           fetch-depth: 0