diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d40d8677582..088c5077db0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,7 +10,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@v2
         with:
           fetch-depth: 1
 
@@ -46,7 +46,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@v2
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b9f6c723048..76d7de7a0d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,18 +27,12 @@ jobs:
     # TODO Share steps with the main workflow.
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v2
 
       - uses: actions/setup-node@v1
         with:
           node-version: '10.18.1'
 
-      # The checkout action does not fetch the master branch.
-      # Fetch the master branch so that we can base the version bump PR against master.
-      - name: Fetch master branch
-        run: |
-          git fetch --depth=1 origin master:master
-
       - name: Build
         run: |
           cd build
@@ -99,6 +93,13 @@ jobs:
           asset_name: ${{ format('vscode-codeql-{0}.vsix', steps.prepare-artifacts.outputs.ref_name) }}
           asset_content_type: application/zip
 
+      # The checkout action does not fetch the master branch.
+      # Fetch the master branch so that we can base the version bump PR against master.
+      - name: Fetch master branch
+        run: |
+          git fetch --depth=1 origin master:master
+          git checkout master
+
       - name: Bump patch version
         id: bump-patch-version
         if: success()
@@ -110,7 +111,7 @@ jobs:
           echo "::set-output name=next_version::$NEXT_VERSION"
 
       - name: Create version bump PR
-        uses: peter-evans/create-pull-request@c202684c928d4c9f18394b2ad11df905c5d8b40c # v2.1.2
+        uses: peter-evans/create-pull-request@c7b64af0a489eae91f7890f2c1b63d13cc2d8ab7 # v2.4.2
         if: success()
         with:
           token: ${{ secrets.GITHUB_TOKEN }}