diff --git a/.github/workflows/actions-versions-updater.yml b/.github/workflows/actions-versions-updater.yml
index 552c93335..1fea2c55a 100644
--- a/.github/workflows/actions-versions-updater.yml
+++ b/.github/workflows/actions-versions-updater.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
         with:
           token: ${{ secrets.WORKFLOW_TOKEN }}
       - name: Run GitHub Actions Version Updater
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 575d31f21..78f2bc8a0 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -29,7 +29,7 @@ jobs:
     name: Bumpversion Patch
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
         with:
           persist-credentials: false
       - uses: actions/setup-python@v4.7.0
diff --git a/.github/workflows/cache-cleaner.yml b/.github/workflows/cache-cleaner.yml
index 8e2ece801..bc5a07165 100644
--- a/.github/workflows/cache-cleaner.yml
+++ b/.github/workflows/cache-cleaner.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@v4.1.0
 
       - name: Cleanup
         run: |
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e58335449..b54ffc7c1 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,7 +35,7 @@ jobs:
           - 'python'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@v4.1.0
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@codeql-bundle-20230524
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 64398fa73..3611c63ec 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -16,6 +16,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@v4.1.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3.0.8
+        uses: actions/dependency-review-action@v3.1.0
diff --git a/.github/workflows/label_on_approval.yml b/.github/workflows/label_on_approval.yml
index 2d58ac3be..2f9431a5b 100644
--- a/.github/workflows/label_on_approval.yml
+++ b/.github/workflows/label_on_approval.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Find comment
-        uses: peter-evans/find-comment@v2
+        uses: peter-evans/find-comment@v2.4.0
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -52,7 +52,7 @@ jobs:
         if: |
           (steps.fc.outputs.comment-id == '') ||
           (!contains(github.event.pull_request.labels.*.name, 'approved'))
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@v3.0.2
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -63,7 +63,7 @@ jobs:
       - name: Update comment
         if: |
           contains(github.event.pull_request.labels.*.name, 'approved')
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@v3.0.2
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ddd0f7d40..56bd2310b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -39,7 +39,7 @@ jobs:
         uses: styfle/cancel-workflow-action@0.11.0
         with:
           access_token: ${{ github.token }}
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Set up Python${{ matrix.python-version }}
         uses: actions/setup-python@v4.7.0
         with:
@@ -63,7 +63,7 @@ jobs:
           - tox-env: "py39"
             python-version: "3.9"
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Set up Python${{ matrix.python-version }}
         uses: actions/setup-python@v4.7.0
         with:
@@ -103,7 +103,7 @@ jobs:
             python-version: "3.11"
             markers: -m 'not slow and not requires_internet'
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Install Eigen3
         if: contains(matrix.tox-env, 'sbck')
         run: |
@@ -140,9 +140,9 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Setup Conda (Micromamba) with Python${{ matrix.python-version }}
-        uses: mamba-org/setup-micromamba@v1.4.3
+        uses: mamba-org/setup-micromamba@v1.4.4
         with:
           cache-downloads: true
           cache-environment: true
diff --git a/.github/workflows/publish-mastodon.yml b/.github/workflows/publish-mastodon.yml
index 706ee5864..3dedb1f2c 100644
--- a/.github/workflows/publish-mastodon.yml
+++ b/.github/workflows/publish-mastodon.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@v4.1.0
 
     - name: Current Version
       if: ${{ !github.event.inputs.version-tag }}
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index b77b5d489..8dd592905 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -14,7 +14,7 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Set up Python3
         uses: actions/setup-python@v4.7.0
         with:
diff --git a/.github/workflows/tag-testpypi.yml b/.github/workflows/tag-testpypi.yml
index edbc542fd..7b9f44e56 100644
--- a/.github/workflows/tag-testpypi.yml
+++ b/.github/workflows/tag-testpypi.yml
@@ -14,7 +14,7 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Set up Python3
         uses: actions/setup-python@v4.7.0
         with:
diff --git a/.github/workflows/testdata_version.yml b/.github/workflows/testdata_version.yml
index 09bf853ea..9d8eb7998 100644
--- a/.github/workflows/testdata_version.yml
+++ b/.github/workflows/testdata_version.yml
@@ -14,7 +14,7 @@ jobs:
     name: Check Latest xclim-testdata Tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
       - name: Find xclim-testdata Tag and CI Testing Branch
         run: |
           XCLIM_TESTDATA_TAG="$( \
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 8b8d77c6e..3bdf19211 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -34,11 +34,11 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.
       - name: Setup Conda (Micromamba) with Python${{ matrix.python-version }}
-        uses: mamba-org/setup-micromamba@v1.4.3
+        uses: mamba-org/setup-micromamba@v1.4.4
         with:
           cache-downloads: true
           cache-environment: true