diff --git a/.github/workflows/metaschema-artifacts.yml b/.github/workflows/metaschema-artifacts.yml
index 5e3f73ee6f..0d918b5e4c 100644
--- a/.github/workflows/metaschema-artifacts.yml
+++ b/.github/workflows/metaschema-artifacts.yml
@@ -32,7 +32,7 @@ jobs:
     outputs:
       skip: ${{ steps.ci-skip-step.outputs.ci-skip }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         with:
           fetch-depth: 0
       - id: ci-skip-step
@@ -44,14 +44,14 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       # use this for main repo master builds
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         if: ${{ github.repository == env.HOME_REPO && github.ref == format('refs/heads/{0}',env.HOME_BRANCH) }}
         with:
           path: ${{ env.OSCAL_HOME }}
           submodules: recursive
           token: ${{ secrets.COMMIT_TOKEN }}
       # use this for pull request builds where checkout uses the builtin token
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         if: ${{ github.repository != env.HOME_REPO || github.ref != format('refs/heads/{0}',env.HOME_BRANCH) }}
         with:
           path: ${{ env.OSCAL_HOME }}
diff --git a/.github/workflows/package-release.yml b/.github/workflows/package-release.yml
index c3b32d4224..0be8686c89 100644
--- a/.github/workflows/package-release.yml
+++ b/.github/workflows/package-release.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       # use this for main repo master builds
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         if: github.repository == env.HOME_REPO
         with:
           path: ${{ env.OSCAL_HOME }}
diff --git a/.github/workflows/validate-repo-markdown.yml b/.github/workflows/validate-repo-markdown.yml
index df1cf4b6a2..9b0f2d0347 100644
--- a/.github/workflows/validate-repo-markdown.yml
+++ b/.github/workflows/validate-repo-markdown.yml
@@ -25,7 +25,7 @@ jobs:
     outputs:
       skip: ${{ steps.ci-skip-step.outputs.ci-skip }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         with:
           fetch-depth: 0
       - id: ci-skip-step
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       # use this for pulls where checkout is anonymous
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         with:
           path: ${{ env.OSCAL_HOME }}
           submodules: recursive
diff --git a/.github/workflows/website-artifacts.yml b/.github/workflows/website-artifacts.yml
index f992bd084f..6897eb5084 100644
--- a/.github/workflows/website-artifacts.yml
+++ b/.github/workflows/website-artifacts.yml
@@ -50,7 +50,7 @@ jobs:
     steps:
       # use this for main repo builds on branches
       - name: Checkout working branch or Tag
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         if: ${{ github.repository == env.HOME_REPO && github.event_name == 'push' }}
         with:
           path: ${{ env.OSCAL_HOME }}
@@ -64,7 +64,7 @@ jobs:
         working-directory: ${{ env.OSCAL_HOME }}
       # use this for pull request builds where checkout uses the builtin token
       - name: Checkout PR
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         if: ${{ github.repository != env.HOME_REPO || github.event_name != 'push' }}
         with:
           path: ${{ env.OSCAL_HOME }}
diff --git a/.github/workflows/website-deploy.yml b/.github/workflows/website-deploy.yml
index f8e48f772d..b40b68dddd 100644
--- a/.github/workflows/website-deploy.yml
+++ b/.github/workflows/website-deploy.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       # use this for main repo builds on branches
       - name: Checkout main branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         if: ${{ github.repository == env.HOME_REPO && github.ref == format('refs/heads/{0}',env.HOME_BRANCH) }}
         with:
           path: ${{ env.OSCAL_HOME }}