diff --git a/.github/workflows/check.buildifier.yml b/.github/workflows/check.buildifier.yml
index 688dd8c..decb234 100644
--- a/.github/workflows/check.buildifier.yml
+++ b/.github/workflows/check.buildifier.yml
@@ -37,7 +37,7 @@ jobs:
         uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
         with:
           egress-policy: audit
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: buildifier
         continue-on-error: true
         run: bazel run --enable_bzlmod //.github/workflows:buildifier.check
diff --git a/.github/workflows/check.codeql.yml b/.github/workflows/check.codeql.yml
index 1e0fbad..cf284af 100644
--- a/.github/workflows/check.codeql.yml
+++ b/.github/workflows/check.codeql.yml
@@ -44,7 +44,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Initialize CodeQL
         uses: github/codeql-action/init@294a9d92911152fe08befb9ec03e240add280cb3 # v3.26.8
         with:
diff --git a/.github/workflows/check.lint-yaml.yml b/.github/workflows/check.lint-yaml.yml
index faab600..f65b55e 100644
--- a/.github/workflows/check.lint-yaml.yml
+++ b/.github/workflows/check.lint-yaml.yml
@@ -63,7 +63,7 @@ jobs:
           allowed-endpoints: >
             github.com:443
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Lint: YAML"
         uses: karancode/yamllint-github-action@0a904064817924fc6fb449a32f67f25bfacc48ae # master
         with:
@@ -90,7 +90,7 @@ jobs:
           allowed-endpoints: >
             github.com:443
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Lint: YAML"
         uses: karancode/yamllint-github-action@0a904064817924fc6fb449a32f67f25bfacc48ae # master
         with:
diff --git a/.github/workflows/check.scorecards.yml b/.github/workflows/check.scorecards.yml
index d69c546..6628b5d 100644
--- a/.github/workflows/check.scorecards.yml
+++ b/.github/workflows/check.scorecards.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           egress-policy: audit
       - name: "Checkout code"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           persist-credentials: false
       - name: "Run analysis"
diff --git a/.github/workflows/deploy.docs.yml b/.github/workflows/deploy.docs.yml
index 7a23b17..36d3b73 100644
--- a/.github/workflows/deploy.docs.yml
+++ b/.github/workflows/deploy.docs.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           egress-policy: audit
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Setup: Pages"
         uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: "Build: Jekyll"
diff --git a/.github/workflows/module.build.yml b/.github/workflows/module.build.yml
index ba39359..e5c053f 100644
--- a/.github/workflows/module.build.yml
+++ b/.github/workflows/module.build.yml
@@ -138,7 +138,7 @@ jobs:
             releases.bazel.build:443
             remote.buildbuddy.io:443
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Setup: msbuild"
         uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
         if: ${{ contains(inputs.runner, 'windows') }}
@@ -394,7 +394,7 @@ jobs:
             repo1.maven.org:443
             maven.pkg.st:443
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Setup: msbuild"
         uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
         if: ${{ contains(inputs.runner, 'windows') }}
diff --git a/.github/workflows/on.pr.yml b/.github/workflows/on.pr.yml
index 19ead2e..64deb03 100644
--- a/.github/workflows/on.pr.yml
+++ b/.github/workflows/on.pr.yml
@@ -36,7 +36,7 @@ jobs:
         with:
           egress-policy: audit
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Report: Dependency Graph"
         continue-on-error: true
         uses: advanced-security/maven-dependency-submission-action@4f64ddab9d742a4806eeb588d238e4c311a8397d # v4.1.1
@@ -54,7 +54,7 @@ jobs:
         with:
           egress-policy: audit
       - name: "Checkout Repository"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Dependency Review"
         uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
         with:
diff --git a/.github/workflows/on.push.yml b/.github/workflows/on.push.yml
index 5806b43..542a76c 100644
--- a/.github/workflows/on.push.yml
+++ b/.github/workflows/on.push.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           egress-policy: audit
       - name: "Setup: Checkout"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: "Report: Dependency Graph"
         continue-on-error: true
         uses: advanced-security/maven-dependency-submission-action@4f64ddab9d742a4806eeb588d238e4c311a8397d # v4.1.1