diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml
index e90c1f68e..0e960139d 100644
--- a/.github/workflows/build-test-images.yml
+++ b/.github/workflows/build-test-images.yml
@@ -45,7 +45,7 @@ jobs:
         with:
           go-version: "1.21.5"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fa8ee950f..a8889cf12 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: golangci/golangci-lint-action@v3
         with:
           version: v1.55.2
@@ -58,7 +58,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
           fetch-depth: 100
@@ -92,7 +92,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
 
@@ -124,7 +124,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: go install github.com/cpuguy83/go-md2man/v2@v2.0.2
       - run: make man
 
@@ -158,7 +158,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: |
           set -e -x
 
@@ -216,7 +216,7 @@ jobs:
           go-version: ${{ matrix.go-version }}
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # NOTE(aznashwan): starting with Golang 1.21, the windows-2019 GitHub runner's
       # builtin MinGW version leads to DLL loading errors during runtime.
@@ -257,11 +257,11 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           repository: kubernetes-sigs/cri-tools
           path: src/github.com/kubernetes-sigs/cri-tools
@@ -416,7 +416,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Install containerd dependencies
         env:
@@ -558,7 +558,7 @@ jobs:
           cat /etc/os-release
           cat /proc/cpuinfo
           free -mt
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: actions/cache@v3
         with:
           path: /root/.vagrant.d
@@ -593,7 +593,7 @@ jobs:
     needs: [project, linters, protos, man]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Set up cgroup v2 delegation
         run: |
           sudo mkdir -p /etc/systemd/system/user@.service.d
@@ -622,7 +622,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: false # see actions/setup-go#368
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: script/setup/install-gotestsum
       - run: script/setup/install-teststat
       - name: Tests
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3e95fccf1..3c3cd7661 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - uses: actions/setup-go@v3
         with:
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index a44c0d7ec..ab532c881 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -43,5 +43,5 @@ jobs:
       - uses: actions/setup-go@v3
         with:
           go-version: 1.21.x
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: script/go-test-fuzz.sh
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 6c4893713..ee64b8630 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           go-version: "1.21.5"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
 
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index 7c42a9df6..612bdd493 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -14,7 +14,7 @@ jobs:
     name: lychee
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: lycheeverse/lychee-action@v1.8.0
         with:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 4b1a0f088..33682095f 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
 
@@ -147,7 +147,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: src/github.com/containerd/containerd
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 998aa7d13..126352d48 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.ref }}
           path: src/github.com/containerd/containerd
@@ -93,7 +93,7 @@ jobs:
           releasever="${releasever#refs/tags/}"
           echo "RELEASE_VER=${releasever}" >> $GITHUB_ENV
       - name: Checkout containerd
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Intentionally use github.repository instead of containerd/containerd to
           # make this action runnable on forks.
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 28fb62fb9..b2b4ce548 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/windows-hyperv-periodic.yml b/.github/workflows/windows-hyperv-periodic.yml
index 11732ef0e..35c51484b 100644
--- a/.github/workflows/windows-hyperv-periodic.yml
+++ b/.github/workflows/windows-hyperv-periodic.yml
@@ -55,7 +55,7 @@ jobs:
           GOOGLE_BUCKET: "containerd-integration/logs/windows-ltsc2022-hyperv/"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Install required packages
         run: |
diff --git a/.github/workflows/windows-periodic.yml b/.github/workflows/windows-periodic.yml
index 17a72491c..7ac9c6eaa 100644
--- a/.github/workflows/windows-periodic.yml
+++ b/.github/workflows/windows-periodic.yml
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Install required packages
         run: |