diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 85bcee6..430fc82 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
       # than GITHUB_TOKEN. A PR created by GITHUB_TOKEN cannot trigger CI, so it
       # would arrive with no status checks and could not satisfy branch
       # protection without an admin merge.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         id: app-token
         # Tolerate missing App secrets: the step below falls back to
         # GITHUB_TOKEN, and the release still works — the release PR just needs
diff --git a/.github/workflows/sync-keywords.yml b/.github/workflows/sync-keywords.yml
index 2b8b2c1..12149bf 100644
--- a/.github/workflows/sync-keywords.yml
+++ b/.github/workflows/sync-keywords.yml
@@ -67,7 +67,7 @@ jobs:
       # no checks and could not satisfy branch protection. Fall back to it
       # anyway when the App secrets are absent — the PR then needs an admin
       # merge, which is better than no PR.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         id: app-token
         if: steps.fetch.outputs.changed == 'true'
         continue-on-error: true