diff --git a/.github/workflows/_filechange_checker.yml b/.github/workflows/_filechange_checker.yml
index 92201d961..6e7a2954d 100644
--- a/.github/workflows/_filechange_checker.yml
+++ b/.github/workflows/_filechange_checker.yml
@@ -24,7 +24,7 @@ jobs:
       websitefileschanged: ${{ steps.websitechecker.outputs.websitefileschanged }}
       actionsfileschanged: ${{ steps.actionschecker.outputs.actionsfileschanged }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # only run CI tests if the src folder or workflow actions have changed
       - name: Check for file changes in src/ or .github/workflows/
diff --git a/.github/workflows/binary-publish.yml b/.github/workflows/binary-publish.yml
index 27cb7449c..74f12d192 100644
--- a/.github/workflows/binary-publish.yml
+++ b/.github/workflows/binary-publish.yml
@@ -9,7 +9,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Get version string
         id: version
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Publish Binary
         uses: ./.github/actions/publish-binary
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 22dc7453a..0b40aa696 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
       run:
         working-directory: src
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # single setup and sum cache handling here.
       # the results will cascade onto both testing and linting.
@@ -63,7 +63,7 @@ jobs:
       website-bucket: ${{ steps.website-bucket.outputs.website-bucket }}
       website-cfid: ${{ steps.website-cfid.outputs.website-cfid }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Figure out environment
         id: environment
@@ -113,7 +113,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main' || needs.precheck.outputs.websitefileschanged == 'true' # websitefileschanged also includes srcfileschanged
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Lint Website
         uses: ./.github/actions/website-linting
@@ -140,7 +140,7 @@ jobs:
       CORSO_LOG_FILE: ${{ github.workspace }}/src/testlog/run-ci.log
       LOG_GRAPH_REQUESTS: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v4
@@ -211,7 +211,7 @@ jobs:
       CORSO_LOG_FILE: ${{ github.workspace }}/src/testlog/run-ci-retention.log
       LOG_GRAPH_REQUESTS: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v4
@@ -279,7 +279,7 @@ jobs:
       LOG_GRAPH_REQUESTS: true
       CORSO_ENABLE_GROUPS: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v4
@@ -360,7 +360,7 @@ jobs:
 
       # Check out merge commit
       - name: Fork based /ok-to-test checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: "refs/pull/${{ github.event.client_payload.pull_request.number }}/merge"
 
@@ -454,7 +454,7 @@ jobs:
       run:
         working-directory: src
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v4
@@ -500,7 +500,7 @@ jobs:
     runs-on: ubuntu-latest
     if: needs.precheck.outputs.actionsfileschanged == 'true'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: actionlint
         uses: raven-actions/actionlint@v1
@@ -525,7 +525,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Publish Binary
         uses: ./.github/actions/publish-binary
@@ -547,7 +547,7 @@ jobs:
     env:
       PLATFORMS: linux/amd64,linux/arm64
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # Setup buildx
       - name: Set up QEMU
@@ -685,7 +685,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v3 # need to checkout to make the action available
+      - uses: actions/checkout@v4 # need to checkout to make the action available
 
       - name: Publish website
         uses: ./.github/actions/publish-website
@@ -701,7 +701,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
 
     steps:
-      - uses: actions/checkout@v3 # need to checkout to make the action available
+      - uses: actions/checkout@v4 # need to checkout to make the action available
 
       - name: Publish website
         uses: ./.github/actions/publish-website
diff --git a/.github/workflows/ci_test_cleanup.yml b/.github/workflows/ci_test_cleanup.yml
index 3687c0e0c..cf90823b1 100644
--- a/.github/workflows/ci_test_cleanup.yml
+++ b/.github/workflows/ci_test_cleanup.yml
@@ -15,7 +15,7 @@ jobs:
         user: [ CORSO_M365_TEST_USER_ID, CORSO_SECONDARY_M365_TEST_USER_ID, '' ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # sets the maximum time to now-30m.
       # CI test have a 20 minute timeout.
@@ -50,7 +50,7 @@ jobs:
         site: [ CORSO_M365_TEST_SITE_URL ] 
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # sets the maximum time to now-30m.
       # CI test have a 20 minute timeout.
diff --git a/.github/workflows/load_test.yml b/.github/workflows/load_test.yml
index 7c93ce19b..45ac8d7e2 100644
--- a/.github/workflows/load_test.yml
+++ b/.github/workflows/load_test.yml
@@ -26,7 +26,7 @@ jobs:
       run:
         working-directory: src
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Build the otel-daemon
         run: make build-otel-daemon
@@ -120,7 +120,7 @@ jobs:
     outputs:
       matrix: ${{ steps.build.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: build
         run: |
           u=$(echo "${{ secrets.CORSO_M365_LOAD_TEST_ORG_USERS }}" | sed 's/\[/["/g' | sed 's/\]/"]/g' | sed 's/|/","/g')
@@ -140,7 +140,7 @@ jobs:
       matrix:
         user: [ CORSO_M365_LOAD_TEST_USER_ID, '' ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Set folder boundary datetime
         run: |
           echo "NOW=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_ENV
diff --git a/.github/workflows/longevity_test.yml b/.github/workflows/longevity_test.yml
index 8d7a3f55a..af9435c4a 100644
--- a/.github/workflows/longevity_test.yml
+++ b/.github/workflows/longevity_test.yml
@@ -50,7 +50,7 @@ jobs:
     ############################################################################
     # setup
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0 # needed to get latest tag
 
diff --git a/.github/workflows/nightly_test.yml b/.github/workflows/nightly_test.yml
index df51b4e66..e9447575d 100644
--- a/.github/workflows/nightly_test.yml
+++ b/.github/workflows/nightly_test.yml
@@ -30,7 +30,7 @@ jobs:
       run:
         working-directory: src
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # single setup and sum cache handling here.
       # the results will cascade onto both testing and linting.
@@ -61,7 +61,7 @@ jobs:
       CLIENT_APP_SLOT: ${{ needs.SetM365App.outputs.client_app_slot }}
       CORSO_ENABLE_GROUPS: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v4
diff --git a/.github/workflows/sanity-test.yaml b/.github/workflows/sanity-test.yaml
index 3bd0c3d11..d61314724 100644
--- a/.github/workflows/sanity-test.yaml
+++ b/.github/workflows/sanity-test.yaml
@@ -50,7 +50,7 @@ jobs:
 # setup
     steps:
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Setup Golang with cache
         uses: magnetikonline/action-golang-cache@v4
diff --git a/.github/workflows/website-publish.yml b/.github/workflows/website-publish.yml
index dda3909e9..4581d9bfe 100644
--- a/.github/workflows/website-publish.yml
+++ b/.github/workflows/website-publish.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0 # needed to get latest tag
 
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Lint Website
         uses: ./.github/actions/website-linting
@@ -56,7 +56,7 @@ jobs:
         working-directory: website
 
     steps:
-      - uses: actions/checkout@v3 # need to checkout to make the action available
+      - uses: actions/checkout@v4 # need to checkout to make the action available
 
       - name: Publish website
         uses: ./.github/actions/publish-website