diff --git a/.github/workflows/apps.release.yaml b/.github/workflows/apps.release.yaml
index 32a6fdb5d14..b4d3cbdfe0e 100644
--- a/.github/workflows/apps.release.yaml
+++ b/.github/workflows/apps.release.yaml
@@ -15,14 +15,14 @@ jobs:
       image: ghcr.io/truecharts/devcontainer:v2.2.1
     steps:
 
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         name: Checkout
         with:
           fetch-depth: 100
           token: ${{ secrets.BOT_TOKEN }}
 
       - name: Checkout
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         with:
           repository: truecharts/catalog
           token: ${{ secrets.BOT_TOKEN }}
diff --git a/.github/workflows/apps.test.yaml b/.github/workflows/apps.test.yaml
index 4fea6aa027e..03773b9b264 100644
--- a/.github/workflows/apps.test.yaml
+++ b/.github/workflows/apps.test.yaml
@@ -21,7 +21,7 @@ jobs:
       empty_matrix: ${{ steps.reduce.outputs.empty_matrix }}
     steps:
     - name: Checkout
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
     - uses: dorny/paths-filter@v2
       id: filter
       with:
@@ -63,7 +63,7 @@ jobs:
     ##
       - name: Checkout
         if: ${{ matrix.app != '.gitkee' }}
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         with:
           fetch-depth: 0
 
@@ -177,13 +177,13 @@ jobs:
             ~/.cache/helm/repository
             ~/.config/helm/repositories.yaml
 
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         name: Checkout
         with:
           fetch-depth: 100
 
       - name: Checkout
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         with:
           repository: truecharts/catalog
           path: catalog
diff --git a/.github/workflows/common.test.yaml b/.github/workflows/common.test.yaml
index 0ad59b54161..5d8629a0f33 100644
--- a/.github/workflows/common.test.yaml
+++ b/.github/workflows/common.test.yaml
@@ -29,7 +29,7 @@ jobs:
             ~/.cache/helm/repository
             ~/.config/helm/repositories.yaml
 
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         name: Checkout
         with:
           fetch-depth: 100
@@ -65,7 +65,7 @@ jobs:
             ~/.cache/helm/repository
             ~/.config/helm/repositories.yaml
 
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         name: Checkout
         with:
           fetch-depth: 100
diff --git a/.github/workflows/docs.deploy.yaml b/.github/workflows/docs.deploy.yaml
index 44eb8ac792c..7dc562f7e6a 100644
--- a/.github/workflows/docs.deploy.yaml
+++ b/.github/workflows/docs.deploy.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
 
diff --git a/.github/workflows/general.security-scan.yaml b/.github/workflows/general.security-scan.yaml
index 4a40304fb80..a48ad2e9d35 100644
--- a/.github/workflows/general.security-scan.yaml
+++ b/.github/workflows/general.security-scan.yaml
@@ -17,7 +17,7 @@ jobs:
     outputs:
       dir: ${{ steps.set-dirs.outputs.dir }} # generate output name dir by using inner step output
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
       - id: set-dirs # Give it an id to handle to get step outputs in the outputs key above
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
 
     - name: Run Trivy vulnerability scanner in repo mode
       uses: aquasecurity/trivy-action@master
diff --git a/.github/workflows/prune.yaml b/.github/workflows/prune.yaml
index 453041e274e..48acb62e5fe 100644
--- a/.github/workflows/prune.yaml
+++ b/.github/workflows/prune.yaml
@@ -9,7 +9,7 @@ jobs:
     name: "prune old releases"
     steps:
     - name: Checkout
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
       with:
         fetch-depth: 0
     - uses: actions/delete-package-versions@5aa567b6f700ebac0a9f17fc162e163bda8912fd # renovate: tag=v2
diff --git a/.github/workflows/renovate-bump.yaml b/.github/workflows/renovate-bump.yaml
index 97334742a56..9e1edab1291 100644
--- a/.github/workflows/renovate-bump.yaml
+++ b/.github/workflows/renovate-bump.yaml
@@ -12,12 +12,12 @@ jobs:
     name: Get changed Apps
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         name: Checkout
         with:
           fetch-depth: 0
           token: ${{ secrets.BOT_TOKEN }}
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
         name: Checkout
         with:
           fetch-depth: 0