diff --git a/.github/workflows/probe-release-app-workflows-permission.yml b/.github/workflows/probe-release-app-workflows-permission.yml
index c2a99870ec..7852e12ea1 100644
--- a/.github/workflows/probe-release-app-workflows-permission.yml
+++ b/.github/workflows/probe-release-app-workflows-permission.yml
@@ -33,7 +33,7 @@ jobs:
           echo "client-id=${client_id}" >> "${GITHUB_OUTPUT}"
 
       - name: Mint release draft capability token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ steps.app.outputs.client-id }}
           private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml
index 037d92305f..7125a17269 100644
--- a/.github/workflows/sync-workflow-templates.yml
+++ b/.github/workflows/sync-workflow-templates.yml
@@ -95,7 +95,7 @@ jobs:
       - name: Create LibreCode GitHub App token
         if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == '' || vars.WORKFLOW_SYNC_AUTH_MODE == 'librecode-app' }}
         id: librecode-app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
           private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
@@ -108,7 +108,7 @@ jobs:
       - name: Create consumer GitHub App token
         if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == 'github-app' }}
         id: consumer-app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
           private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}