diff --git a/.changelog/460.internal.md b/.changelog/460.internal.md
new file mode 100644
index 00000000..101b31a8
--- /dev/null
+++ b/.changelog/460.internal.md
@@ -0,0 +1 @@
+ci: bump actions/checkout from 3 to 4
diff --git a/.github/workflows/ci-dependabot.yml b/.github/workflows/ci-dependabot.yml
index d0358309..abb380a4 100644
--- a/.github/workflows/ci-dependabot.yml
+++ b/.github/workflows/ci-dependabot.yml
@@ -21,7 +21,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Needed for correct git commit --amend.
           fetch-depth: 0
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
index f69e5725..b8c0ebf4 100644
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Check out pull request's HEAD commit instead of the merge commit to
           # prevent gitlint from failing due to too long commit message titles,
@@ -86,7 +86,7 @@ jobs:
         # Always run this step so that all linting errors can be seen at once.
         if: always()
       - name: Ensure a clean code checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           clean: true
         if: always()
diff --git a/.github/workflows/ci-tests.yaml b/.github/workflows/ci-tests.yaml
index a064358f..31019db7 100644
--- a/.github/workflows/ci-tests.yaml
+++ b/.github/workflows/ci-tests.yaml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Set up Go 1.19
         uses: actions/setup-go@v4
         with:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0ae8bcdd..27f42cd0 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Determine branch and tag name
         id: branch_tag
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b45c6cf7..2ae8d5a1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Fetch all history as the recommended way to fetch all tags and
           # branches of the project.