diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml
index 9b6a797702..140658eb05 100644
--- a/.github/workflows/coverity-scan.yml
+++ b/.github/workflows/coverity-scan.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         with:
           submodules: "recursive"
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 12cb66df6b..9e27d4fc8e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -28,7 +28,7 @@ jobs:
       TEST_TAG: zeek:latest
       CONFFLAGS: --generator=Ninja --build-type=Release
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         with:
           submodules: "recursive"
 
@@ -77,7 +77,7 @@ jobs:
           fi
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         # Don't publish on forks. Also note that secrets for the login are not
         # available for pull requests, so trigger on pushes only.
         if: github.repository == 'zeek/zeek' && github.event_name == 'push'
@@ -99,14 +99,14 @@ jobs:
             zeekurity/${{ steps.target.outputs.tag }}
 
       - name: Preserve image artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: ${{ env.IMAGE_NAME }}
           path: ${{ env.IMAGE_FILE }}
           retention-days: 1
 
       - name: Preserve btest artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: failure()
         with:
           name: docker-btest
@@ -122,7 +122,7 @@ jobs:
       # Grab the sources so we have access to btest. Could also use pip, but it
       # seems appealing to be using the in-tree version of btest. btest is in a
       # submodule; we check it out selectively to save time.
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
       - name: Check out btest
         run: git submodule update --init ./auxil/btest
 
@@ -144,7 +144,7 @@ jobs:
           echo "TESTSUITE_COMMIT=$(cat ./testing/external/commit-hash.zeek-testing-cluster)" >> $GITHUB_ENV
 
       - name: Retrieve cluster testsuite
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         with:
           repository: zeek/zeek-testing-cluster
           path: testing/external/zeek-testing-cluster
@@ -162,7 +162,7 @@ jobs:
           find testing/external/zeek-testing-cluster/.tmp -depth -execdir rename 's/[":<>|*?\r\n]/./g' "{}" \;
 
       - name: Preserve btest artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: failure()
         with:
           name: cluster-btest
@@ -176,7 +176,7 @@ jobs:
           truncate -s0 ${{ env.IMAGE_FILE }}
 
       - name: Store truncated image artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: ${{ env.IMAGE_NAME }}
           path: ${{ env.IMAGE_FILE }}
diff --git a/.github/workflows/generate-docs.yml b/.github/workflows/generate-docs.yml
index 6bf45e51e3..39f22a193e 100644
--- a/.github/workflows/generate-docs.yml
+++ b/.github/workflows/generate-docs.yml
@@ -24,12 +24,12 @@ jobs:
       # event, so we only need to authenticate in that case. Use
       # unauthenticated access otherwise so this action can e.g., also run from
       # clones.
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         if: github.event_name == 'schedule'
         with:
           submodules: "recursive"
           token: ${{ secrets.ZEEK_BOT_TOKEN }}
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.1.0
         if: github.event_name != 'schedule'
         with:
           submodules: "recursive"
@@ -121,7 +121,7 @@ jobs:
         # Only send notifications for scheduled runs. Runs from pull requests
         # show failures in the Github UI.
         if: failure() && github.event_name == 'schedule'
-        uses: dawidd6/action-send-mail@v3.6.1
+        uses: dawidd6/action-send-mail@v3.7.0
         with:
           server_address: ${{secrets.SMTP_HOST}}
           server_port: ${{secrets.SMTP_PORT}}
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 3e9e012b78..2c8a091925 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -9,6 +9,6 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions/setup-python@v2
+    - uses: actions/checkout@v3.1.0
+    - uses: actions/setup-python@v4
     - uses: pre-commit/action@v3.0.0