diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e884e98..58bd1b0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
           # install upx-stubtools
           wget -q -O - https://github.com/upx/upx-stubtools/releases/download/v20221212/bin-upx-20221212.tar.xz | tar -xJ
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Rebuild and verify stubs'
         run: |
@@ -75,7 +75,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y g++-multilib g++-mingw-w64-i686 g++-mingw-w64-x86-64
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Check out test suite'
         run: 'git clone --depth=1 https://github.com/upx/upx-testsuite ../deps/upx-testsuite'
@@ -161,7 +161,7 @@ jobs:
             if ! brew install coreutils; then brew update && brew install coreutils; fi
           fi
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Check out test suite'
         if: ${{ matrix.testsuite }}
@@ -238,7 +238,7 @@ jobs:
           - { name: windows-2022-amd64, os: windows-2022, vsversion: 2022, arch: amd64 }
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Check out test suite'
         run: 'git clone --depth=1 https://github.com/upx/upx-testsuite ../deps/upx-testsuite'
@@ -300,7 +300,7 @@ jobs:
           - { name: i386-win32-vs2022,    os: windows-2022, vsversion: 2022, arch: amd64_x86 }
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Prepare sources and Check out test suite'
         shell: bash
@@ -436,7 +436,7 @@ jobs:
           # this seems to be needed when running in a container (beause of UID mismatch??)
           git config --global --add safe.directory '*'
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: ${{ format('Install Zig {0}', env.ZIG_DIST_VERSION) }}
         shell: bash
diff --git a/.github/workflows/misc-spell-check.yml b/.github/workflows/misc-spell-check.yml
index 8a118f65..ec8040f2 100644
--- a/.github/workflows/misc-spell-check.yml
+++ b/.github/workflows/misc-spell-check.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: false }
       - name: 'Spell check with crate-ci/typos'
         uses: crate-ci/typos@master
diff --git a/.github/workflows/static-analyzer-codeql.yml b/.github/workflows/static-analyzer-codeql.yml
index 6e677f67..667fc336 100644
--- a/.github/workflows/static-analyzer-codeql.yml
+++ b/.github/workflows/static-analyzer-codeql.yml
@@ -23,7 +23,7 @@ jobs:
         language: [ 'cpp' ]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.github/workflows/test-cmake-default.yml b/.github/workflows/test-cmake-default.yml
index 82bae60a..af2977ed 100644
--- a/.github/workflows/test-cmake-default.yml
+++ b/.github/workflows/test-cmake-default.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Config, build, test and install'
         run: |
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Config, build, test and install'
         run: |
@@ -51,7 +51,7 @@ jobs:
     runs-on: windows-2022
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
         uses: ilammy/msvc-dev-cmd@v1
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Config, build, test and install'
         run: |
@@ -100,7 +100,7 @@ jobs:
     runs-on: windows-2022
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
         uses: ilammy/msvc-dev-cmd@v1
@@ -120,7 +120,7 @@ jobs:
     runs-on: macos-12
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Config, build, test and install'
         run: |
diff --git a/.github/workflows/weekly-ci-bs-by-hand.yml b/.github/workflows/weekly-ci-bs-by-hand.yml
index 9078ff0d..accb1150 100644
--- a/.github/workflows/weekly-ci-bs-by-hand.yml
+++ b/.github/workflows/weekly-ci-bs-by-hand.yml
@@ -33,7 +33,7 @@ jobs:
           # this seems to be needed when running in a container (beause of UID mismatch??)
           git config --global --add safe.directory '*'
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: true
           path: 'upx with space'
diff --git a/.github/workflows/weekly-ci-bs-cmake-macos-xcode.yml b/.github/workflows/weekly-ci-bs-cmake-macos-xcode.yml
index e1e19874..f222e9c4 100644
--- a/.github/workflows/weekly-ci-bs-cmake-macos-xcode.yml
+++ b/.github/workflows/weekly-ci-bs-cmake-macos-xcode.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - { name: 'Config cmake Xcode',        run: 'cmake -S . -B build/xcode -G Xcode' }
       - { name: 'Build cmake Xcode default', run: 'cmake --build build/xcode' }
diff --git a/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml b/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml
index 6aef858f..d0e6e72b 100644
--- a/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml
+++ b/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
         uses: ilammy/msvc-dev-cmd@v1
diff --git a/.github/workflows/weekly-ci-cc-llvm-mingw.yml b/.github/workflows/weekly-ci-cc-llvm-mingw.yml
index d09caf3a..43abd68a 100644
--- a/.github/workflows/weekly-ci-cc-llvm-mingw.yml
+++ b/.github/workflows/weekly-ci-cc-llvm-mingw.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: ${{ format('Install {0} {1}', matrix.name, matrix.llvm_version) }}
         run: |
diff --git a/.github/workflows/weekly-ci-cc-zigcc.yml b/.github/workflows/weekly-ci-cc-zigcc.yml
index a2fe219d..667ad5a9 100644
--- a/.github/workflows/weekly-ci-cc-zigcc.yml
+++ b/.github/workflows/weekly-ci-cc-zigcc.yml
@@ -64,7 +64,7 @@ jobs:
           # this seems to be needed when running in a container (beause of UID mismatch??)
           git config --global --add safe.directory '*'
       - name: 'Check out code'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with: { submodules: true }
       - name: ${{ format('Install Zig {0}', env.ZIG_DIST_VERSION) }}
         shell: bash