diff --git a/.github/workflows/app-build-verify.yml b/.github/workflows/app-build-verify.yml
index 4c78d80a..2aec7d28 100644
--- a/.github/workflows/app-build-verify.yml
+++ b/.github/workflows/app-build-verify.yml
@@ -87,13 +87,13 @@ jobs:
         echo "system-python-version=${SYSTEM_PYTHON_VER}" | tee -a ${GITHUB_OUTPUT}
 
     - name: Checkout ${{ inputs.repository }}
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ inputs.repository }}
         fetch-depth: 0
 
     - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ inputs.workflow-repo }}
         ref: ${{ inputs.workflow-repo-ref }}
diff --git a/.github/workflows/app-create-verify.yml b/.github/workflows/app-create-verify.yml
index b23e3fc2..a10854c4 100644
--- a/.github/workflows/app-create-verify.yml
+++ b/.github/workflows/app-create-verify.yml
@@ -45,20 +45,20 @@ jobs:
     steps:
 
     - name: Checkout ${{ github.repository }}
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ github.repository }}
         fetch-depth: 0
 
     - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ inputs.workflow-repo }}
         ref: ${{ inputs.workflow-repo-ref }}
         path: beeware-.github
 
     - name: Checkout beeware/briefcase-template
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: beeware/briefcase-template
         path: briefcase-template
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 96edbc84..53f60591 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           expected: "main"
     steps:
     - name: Checkout beeware/.github
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
 
     - name: Set up Python
       uses: actions/setup-python@v5.1.0
diff --git a/.github/workflows/dep-version-bump.yml b/.github/workflows/dep-version-bump.yml
index f55570f8..811f9e1b 100644
--- a/.github/workflows/dep-version-bump.yml
+++ b/.github/workflows/dep-version-bump.yml
@@ -51,13 +51,13 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4.1.3
         with:
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
           path: "repo"
 
       - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4.1.3
         with:
           repository: ${{ inputs.workflow-repo }}
           ref: ${{ inputs.workflow-repo-ref }}
diff --git a/.github/workflows/dependabot-changenote.yml b/.github/workflows/dependabot-changenote.yml
index fc56c6db..889d3ace 100644
--- a/.github/workflows/dependabot-changenote.yml
+++ b/.github/workflows/dependabot-changenote.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4.1.3
         with:
           fetch-depth: 1
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/workflows/pre-commit-run.yml b/.github/workflows/pre-commit-run.yml
index 1f4b300f..66132769 100644
--- a/.github/workflows/pre-commit-run.yml
+++ b/.github/workflows/pre-commit-run.yml
@@ -36,7 +36,7 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ inputs.repository }}
 
diff --git a/.github/workflows/pre-commit-update.yml b/.github/workflows/pre-commit-update.yml
index 149d2483..6e65ca33 100644
--- a/.github/workflows/pre-commit-update.yml
+++ b/.github/workflows/pre-commit-update.yml
@@ -43,7 +43,7 @@ jobs:
       hook-repos: ${{ steps.hooks.outputs.repos }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4.1.3
 
       - name: Get Pre-commit Hooks
         id: hooks
@@ -62,7 +62,7 @@ jobs:
         hook-repo: ${{ fromJson(needs.pre-commit-hooks.outputs.hook-repos) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4.1.3
         with:
           fetch-depth: 1
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/workflows/python-package-create.yml b/.github/workflows/python-package-create.yml
index d34c317d..3450a192 100644
--- a/.github/workflows/python-package-create.yml
+++ b/.github/workflows/python-package-create.yml
@@ -62,7 +62,7 @@ jobs:
         run: echo "name=$(basename '${{ inputs.repository }}')" >> ${GITHUB_OUTPUT}
 
       - name: Checkout
-        uses: actions/checkout@v4.1.2
+        uses: actions/checkout@v4.1.3
         with:
           repository: ${{ inputs.repository }}
           fetch-depth: 0  # Fetch all refs so setuptools_scm can generate the correct version number
diff --git a/.github/workflows/towncrier-run.yml b/.github/workflows/towncrier-run.yml
index 2072974f..03cf8cad 100644
--- a/.github/workflows/towncrier-run.yml
+++ b/.github/workflows/towncrier-run.yml
@@ -39,14 +39,14 @@ jobs:
     steps:
 
     - name: Checkout Default Branch
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ inputs.repository }}
         ref: ${{ github.event.repository.default_branch }}
         fetch-depth: 0
 
     - name: Checkout Current Branch
-      uses: actions/checkout@v4.1.2
+      uses: actions/checkout@v4.1.3
       with:
         repository: ${{ inputs.repository }}
         fetch-depth: 0