diff --git a/.github/workflows/haskell-ci-dependabot.patch b/.github/workflows/haskell-ci-dependabot.patch
new file mode 100644
index 0000000..2f4db72
--- /dev/null
+++ b/.github/workflows/haskell-ci-dependabot.patch
@@ -0,0 +1,23 @@
+Bump some GitHub Actions versions to prevent Dependabot from opening pull
+requests every time we regenerate the haskell-ci workflow.
+
+--- .github/workflows/haskell-ci.yml.orig
++++ .github/workflows/haskell-ci.yml
+@@ -190,7 +190,7 @@ jobs:
+           chmod a+x $HOME/.cabal/bin/cabal-plan
+           cabal-plan --version
+       - name: checkout
+-        uses: actions/checkout@v2
++        uses: actions/checkout@v3
+         with:
+           path: source
+       - name: autoreconf
+@@ -231,7 +231,7 @@ jobs:
+           $CABAL v2-build $ARG_COMPILER $ARG_TESTS $ARG_BENCH --dry-run all
+           cabal-plan
+       - name: cache
+-        uses: actions/cache@v2
++        uses: actions/cache@v3
+         with:
+           key: ${{ runner.os }}-${{ matrix.compiler }}-${{ github.sha }}
+           path: ~/.cabal/store
diff --git a/.github/workflows/haskell-ci-hackage.patch b/.github/workflows/haskell-ci-hackage.patch
index cc45e22..2e551ce 100644
--- a/.github/workflows/haskell-ci-hackage.patch
+++ b/.github/workflows/haskell-ci-hackage.patch
@@ -57,12 +57,12 @@ set in GitHub repository secrets.
            $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks all
 +      - name: upload artifacts (sdist)
 +        if: matrix.upload
-+        uses: actions/upload-artifact@v2
++        uses: actions/upload-artifact@v3
 +        with:
 +          path: ${{ github.workspace }}/sdist/*.tar.gz
 +      - name: upload artifacts (haddock)
 +        if: matrix.upload
-+        uses: actions/upload-artifact@v2
++        uses: actions/upload-artifact@v3
 +        with:
 +          path: ${{ github.workspace }}/haddock/*-docs.tar.gz
 +      - name: hackage upload (candidate)
diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index 3bbd15a..b866e81 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -170,7 +170,7 @@ jobs:
           chmod a+x $HOME/.cabal/bin/cabal-plan
           cabal-plan --version
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: source
       - name: initial cabal.project for sdist
@@ -210,7 +210,7 @@ jobs:
           $CABAL v2-build $ARG_COMPILER $ARG_TESTS $ARG_BENCH --dry-run all
           cabal-plan
       - name: cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           key: ${{ runner.os }}-${{ matrix.compiler }}-${{ github.sha }}
           path: ~/.cabal/store
@@ -241,12 +241,12 @@ jobs:
           $CABAL v2-build $ARG_COMPILER --disable-tests --disable-benchmarks all
       - name: upload artifacts (sdist)
         if: matrix.upload
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           path: ${{ github.workspace }}/sdist/*.tar.gz
       - name: upload artifacts (haddock)
         if: matrix.upload
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           path: ${{ github.workspace }}/haddock/*-docs.tar.gz
       - name: hackage upload (candidate)
diff --git a/cabal.haskell-ci b/cabal.haskell-ci
index c0828fe..9a7a6bc 100644
--- a/cabal.haskell-ci
+++ b/cabal.haskell-ci
@@ -6,6 +6,7 @@ apt:
   libxss-dev
 
 github-patches:
+  .github/workflows/haskell-ci-dependabot.patch
   .github/workflows/haskell-ci-hackage.patch
 
 raw-project