diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml
index 2b924db14f4..23fed4af737 100644
--- a/.github/workflows/ansible-lint.yml
+++ b/.github/workflows/ansible-lint.yml
@@ -14,7 +14,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         lfs: false # not needed for this job, as we don’t currently do a Java build
     - name: Lint Ansible Playbook
@@ -27,7 +27,7 @@ jobs:
   testprovision:
     runs-on: macos-10.15  # see https://github.com/actions/virtual-environments/issues/4060
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         lfs: false # not needed for this job, as we don’t currently do a Java build
     - name: Install Vagrant and Ansible
diff --git a/.github/workflows/build-icu.yml b/.github/workflows/build-icu.yml
index 55aa52b384a..792943828e6 100644
--- a/.github/workflows/build-icu.yml
+++ b/.github/workflows/build-icu.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone CLDR
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.cldr-ref }}
           lfs: false
@@ -113,14 +113,14 @@ jobs:
         run: mkdir -p cldr cldr-prod && cd cldr-prod && unzip ../cldr-prod.zip
       # Don't actually need CLDR
       # - name: Clone CLDR
-      #   uses: actions/checkout@v3
+      #   uses: actions/checkout@v4
       #   with:
       #     ref: ${{ github.event.inputs.cldr-ref }}
       #     lfs: false
       #     repository: ${{ github.event.inputs.cldr-repo }}
       #     path: cldr
       - name: Clone ICU
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: ${{ github.event.inputs.icu-repo }}
           ref: ${{ github.event.inputs.icu-ref }}
@@ -170,7 +170,7 @@ jobs:
     needs: genicudata
     steps:
       - name: Clone ICU
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: ${{ github.event.inputs.icu-repo }}
           ref: ${{ github.event.inputs.icu-ref }}
@@ -214,7 +214,7 @@ jobs:
     needs: genicudata
     steps:
       - name: Clone ICU
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: ${{ github.event.inputs.icu-repo }}
           ref: ${{ github.event.inputs.icu-ref }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 8750684903d..5cd584fef0b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Set up JDK
       if: matrix.language == 'java'
       uses: actions/setup-java@v3
diff --git a/.github/workflows/commit-checker.yml b/.github/workflows/commit-checker.yml
index f6e22ce9065..fd0ce6008a4 100644
--- a/.github/workflows/commit-checker.yml
+++ b/.github/workflows/commit-checker.yml
@@ -28,14 +28,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: clone CLDR
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.end-ref }}
           lfs: false # not needed here
           path: cldr
           fetch-depth: 0 # expensive, but we need history for the checker
       - name: clone ICU for tools
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: ${{ github.event.inputs.tool-repository }}
           ref: ${{ github.event.inputs.tool-ref }}
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index b71017968f3..e22950fba83 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -17,7 +17,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           lfs: false
       - name: Cache local npm repository
diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml
index 75f936a8bb8..ebf0ed9e93c 100644
--- a/.github/workflows/js.yml
+++ b/.github/workflows/js.yml
@@ -16,7 +16,7 @@ jobs:
   fetest:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         lfs: false # not needed for this job, as we don’t currently do a Java build
     - uses: nodenv/actions/node-version@v3 # setup using .node-version
diff --git a/.github/workflows/keyboard.yml b/.github/workflows/keyboard.yml
index 7f54ab8425d..c945b89b295 100644
--- a/.github/workflows/keyboard.yml
+++ b/.github/workflows/keyboard.yml
@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
         if: github.event.inputs.git-ref == ''
       - name: Clone Repository (manual ref)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
           ref: ${{ github.event.inputs.git-ref }}
diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml
index 574d864f077..415b6189db4 100644
--- a/.github/workflows/maven-release.yml
+++ b/.github/workflows/maven-release.yml
@@ -7,7 +7,7 @@ jobs:
   mvn-deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           lfs: false
       - name: Set up JDK
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index d56229d1eed..1e8c0ec0110 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -25,7 +25,7 @@ jobs:
             git-${{ github.base_ref }}
             git-
       - name: Checkout CLDR
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
           fetch-depth: 0  # fetch all branches so that Spotless can resolve `origin/main`
@@ -44,13 +44,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
           fetch-depth: 0  # Needed for cldr-archive
         if: github.event.inputs.git-ref == ''
       - name: Clone Repository (manual ref)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
           fetch-depth: 0  # Needed for cldr-archive
@@ -159,12 +159,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
         if: github.event.inputs.git-ref == ''
       - name: Clone Repository (manual ref)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           lfs: false
           ref: ${{ github.event.inputs.git-ref }}
diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml
index be10461290e..1c296b2695d 100644
--- a/.github/workflows/production.yml
+++ b/.github/workflows/production.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone Repository (Custom Ref)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.git-ref }}
           lfs: false
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 4c30ad86844..1161a2e8105 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone Repository (Custom Ref)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.git-ref }}
           repository: ${{ github.event.inputs.repo }}