diff --git a/.github/workflows/01-make-dist-worker.yml b/.github/workflows/01-make-dist-worker.yml
index bb43f2ba04..4eaf6dfab8 100644
--- a/.github/workflows/01-make-dist-worker.yml
+++ b/.github/workflows/01-make-dist-worker.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         # NOTE: This is the unprivileged part of the GHA-01-tarballs ritual,
         #  running potentially untrusted shell code from the PR source branch.
diff --git a/.github/workflows/05-codeql.yml b/.github/workflows/05-codeql.yml
index c5572d1768..0ad832baf0 100644
--- a/.github/workflows/05-codeql.yml
+++ b/.github/workflows/05-codeql.yml
@@ -65,7 +65,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
 
     # Using hints from https://askubuntu.com/questions/272248/processing-triggers-for-man-db
     - if: matrix.language == 'cpp' && matrix.os == 'ubuntu-latest'