diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index fcf5693c..58f0813a 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Annotate locations with typos
         uses: codespell-project/codespell-problem-matcher@v1
       - name: Codespell
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 89921a97..e771e27e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: Checkout pygit2
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Set up Python
       uses: actions/setup-python@v6
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 66303432..e8382bce 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -14,7 +14,7 @@ jobs:
     if: github.ref == 'refs/heads/master'
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Build & test
       uses: uraimo/run-on-arch-action@v3
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index a951b3e7..8445527d 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -36,7 +36,7 @@ jobs:
           os: windows-11-arm
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # avoid leaking credentials in uploaded artifacts
           persist-credentials: false
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # avoid leaking credentials in uploaded artifacts
           persist-credentials: false
@@ -95,7 +95,7 @@ jobs:
     outputs:
       release_title: ${{ steps.parse_changelog.outputs.release_title }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # avoid leaking credentials in uploaded artifacts
           persist-credentials: false