diff --git a/.github/workflows/build-debian-multiarch.yml b/.github/workflows/build-debian-multiarch.yml
index 7040456c33..a8d13b5b1a 100644
--- a/.github/workflows/build-debian-multiarch.yml
+++ b/.github/workflows/build-debian-multiarch.yml
@@ -47,7 +47,7 @@ jobs:
         arch: [s390x, ppc64le]
 
     steps:
-    - uses: actions/checkout@v4.1.1
+    - uses: actions/checkout@v4.1.2
 
     - name: Build sources and run tests
       uses: uraimo/run-on-arch-action@v2.7.1
diff --git a/.github/workflows/build-emsdk.yml b/.github/workflows/build-emsdk.yml
index 90a136d8bf..b1b277532c 100644
--- a/.github/workflows/build-emsdk.yml
+++ b/.github/workflows/build-emsdk.yml
@@ -47,7 +47,7 @@ jobs:
       WHEELHOUSE_CYTHON: /tmp/wheelhouse/cython
 
     steps:
-    - uses: actions/checkout@v4.1.1
+    - uses: actions/checkout@v4.1.2
 
     - name: Cache Cython
       id: cache-cython
diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index f532126ac3..a8fc255f9a 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -45,7 +45,7 @@ jobs:
         macarch: [arm64, x86_64]
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - name: Test for Mac Deps cache hit
         id: macdep-cache
@@ -160,7 +160,7 @@ jobs:
       CIBW_BUILD_VERBOSITY: 2
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - name: pip cache
         uses: actions/cache@v4.0.1
diff --git a/.github/workflows/build-manylinux.yml b/.github/workflows/build-manylinux.yml
index 25d24c23f5..12ac7bc6e5 100644
--- a/.github/workflows/build-manylinux.yml
+++ b/.github/workflows/build-manylinux.yml
@@ -79,7 +79,7 @@ jobs:
       CIBW_BUILD_VERBOSITY: 2
 
     steps:
-    - uses: actions/checkout@v4.1.1
+    - uses: actions/checkout@v4.1.2
 
     - name: Log in to the Container registry
       uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
diff --git a/.github/workflows/build-ubuntu-sdist.yml b/.github/workflows/build-ubuntu-sdist.yml
index c7d64ac8be..648f586e83 100644
--- a/.github/workflows/build-ubuntu-sdist.yml
+++ b/.github/workflows/build-ubuntu-sdist.yml
@@ -51,7 +51,7 @@ jobs:
         os: [ubuntu-20.04, ubuntu-22.04]
 
     steps:
-    - uses: actions/checkout@v4.1.1
+    - uses: actions/checkout@v4.1.2
 
     - name: Install deps
       # install numpy from pip and not apt because the one from pip is newer,
diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 55384fa331..5215399d18 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -146,7 +146,7 @@ jobs:
       CIBW_BUILD_VERBOSITY: 2
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - uses: TheMrMilchmann/setup-msvc-dev@v3  # this lets us use the developer command prompt on windows
         with:
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index b7d374175c..bebcc4efd2 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - name: Install deps
         # https://github.com/actions/runner-images/issues/7192
diff --git a/.github/workflows/format-lint.yml b/.github/workflows/format-lint.yml
index 8e6ccc6f68..76ae29161a 100644
--- a/.github/workflows/format-lint.yml
+++ b/.github/workflows/format-lint.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - name: Install deps
         run: python3 -m pip install pylint black clang-format sphinx"<7.2.0"
diff --git a/.github/workflows/release-gh-draft.yml b/.github/workflows/release-gh-draft.yml
index 7b5043f87d..9707a26ff8 100644
--- a/.github/workflows/release-gh-draft.yml
+++ b/.github/workflows/release-gh-draft.yml
@@ -33,7 +33,7 @@ jobs:
     needs: [manylinux-aarch64, manylinux, macos, windows, sdist]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
diff --git a/.github/workflows/release-pypi.yml b/.github/workflows/release-pypi.yml
index bb27dbcb1c..8c61abe7dc 100644
--- a/.github/workflows/release-pypi.yml
+++ b/.github/workflows/release-pypi.yml
@@ -12,7 +12,7 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4.1.2
 
       - name: Pull all release assets
         uses: robinraju/release-downloader@v1.9