diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 96020e8..8d70b0e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/notify-merged b/.github/workflows/notify-merged
index 3e1a07a..55a0d16 100644
--- a/.github/workflows/notify-merged
+++ b/.github/workflows/notify-merged
@@ -24,7 +24,7 @@ jobs:
       # push 事件需要完整历史用于判别是否为“合并提交”
       - name: "Checkout (push only)"
         if: github.event_name == 'push'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/security-review.yml b/.github/workflows/security-review.yml
index 070b59d..9a091f5 100644
--- a/.github/workflows/security-review.yml
+++ b/.github/workflows/security-review.yml
@@ -112,7 +112,7 @@ jobs:
     
     steps:
       - name: 📥 检出代码
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           # 获取 PR 的 HEAD commit
           ref: ${{ github.event.pull_request.head.sha || github.sha }}