diff --git a/.github/workflows/app-build-verify.yml b/.github/workflows/app-build-verify.yml
index e19d377..8324db7 100644
--- a/.github/workflows/app-build-verify.yml
+++ b/.github/workflows/app-build-verify.yml
@@ -83,13 +83,13 @@ jobs:
         echo "cache-key=$(date +%Y-%m)|${CACHE_KEY}" | tee -a ${GITHUB_OUTPUT}
 
     - name: Checkout ${{ inputs.repository }}
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.repository }}
         fetch-depth: 0
 
     - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.workflow-repo }}
         ref: ${{ inputs.workflow-repo-ref }}
diff --git a/.github/workflows/app-create-verify.yml b/.github/workflows/app-create-verify.yml
index 949deab..e939b64 100644
--- a/.github/workflows/app-create-verify.yml
+++ b/.github/workflows/app-create-verify.yml
@@ -54,20 +54,20 @@ jobs:
         echo "system-python-version=${SYSTEM_PYTHON_VER}" | tee -a ${GITHUB_OUTPUT}
 
     - name: Checkout ${{ inputs.repository }}
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.repository }}
         fetch-depth: 0
 
     - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.workflow-repo }}
         ref: ${{ inputs.workflow-repo-ref }}
         path: beeware-.github
 
     - name: Checkout beeware/briefcase-template
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: beeware/briefcase-template
         path: briefcase-template
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da5ed6c..22b2da6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           expected: "main"
     steps:
     - name: Checkout beeware/.github
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
 
     - name: Set up Python
       uses: actions/setup-python@v5.3.0
@@ -194,18 +194,18 @@ jobs:
         runner-os: [ macos-latest, windows-latest, ubuntu-latest ]
     steps:
       - name: Checkout beeware/briefcase
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           repository: beeware/briefcase
 
       - name: Checkout beeware/briefcase to path
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           repository: beeware/briefcase
           path: repos/briefcase
 
       - name: Checkout beeware/.github
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           repository: beeware/.github
           path: repos/.github-beeware
diff --git a/.github/workflows/dep-version-bump.yml b/.github/workflows/dep-version-bump.yml
index 8552109..d3bb655 100644
--- a/.github/workflows/dep-version-bump.yml
+++ b/.github/workflows/dep-version-bump.yml
@@ -51,13 +51,13 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
           path: "repo"
 
       - name: Checkout ${{ inputs.workflow-repo }}${{ inputs.workflow-repo-ref && format('@{0}', inputs.workflow-repo-ref) || '' }}
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           repository: ${{ inputs.workflow-repo }}
           ref: ${{ inputs.workflow-repo-ref }}
diff --git a/.github/workflows/dependabot-changenote.yml b/.github/workflows/dependabot-changenote.yml
index 36d18db..1d540f4 100644
--- a/.github/workflows/dependabot-changenote.yml
+++ b/.github/workflows/dependabot-changenote.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           fetch-depth: 1
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/workflows/pre-commit-run.yml b/.github/workflows/pre-commit-run.yml
index be2bd17..6ce85b5 100644
--- a/.github/workflows/pre-commit-run.yml
+++ b/.github/workflows/pre-commit-run.yml
@@ -36,7 +36,7 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.repository }}
 
diff --git a/.github/workflows/pre-commit-update.yml b/.github/workflows/pre-commit-update.yml
index ea0d32b..cc570e2 100644
--- a/.github/workflows/pre-commit-update.yml
+++ b/.github/workflows/pre-commit-update.yml
@@ -43,7 +43,7 @@ jobs:
       hook-repos: ${{ steps.hooks.outputs.repos }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
 
       - name: Get Pre-commit Hooks
         id: hooks
@@ -62,7 +62,7 @@ jobs:
         hook-repo: ${{ fromJson(needs.pre-commit-hooks.outputs.hook-repos) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           fetch-depth: 1
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/workflows/python-package-create.yml b/.github/workflows/python-package-create.yml
index 3ce50d9..915da37 100644
--- a/.github/workflows/python-package-create.yml
+++ b/.github/workflows/python-package-create.yml
@@ -58,7 +58,7 @@ jobs:
           echo "differentiator=${DIFFERENTIATOR}" | tee -a ${GITHUB_OUTPUT}
 
       - name: Checkout
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
         with:
           repository: ${{ inputs.repository }}
           fetch-depth: 0  # Fetch all refs so setuptools_scm can generate the correct version number
diff --git a/.github/workflows/towncrier-run.yml b/.github/workflows/towncrier-run.yml
index 5ea4e3a..08cc9d1 100644
--- a/.github/workflows/towncrier-run.yml
+++ b/.github/workflows/towncrier-run.yml
@@ -39,14 +39,14 @@ jobs:
     steps:
 
     - name: Checkout Default Branch
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.repository }}
         ref: ${{ github.event.repository.default_branch }}
         fetch-depth: 0
 
     - name: Checkout Current Branch
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         repository: ${{ inputs.repository }}
         fetch-depth: 0