diff --git a/.github/workflows/manual_release.yml b/.github/workflows/manual_release.yml
index 39947d8..ba55ee0 100644
--- a/.github/workflows/manual_release.yml
+++ b/.github/workflows/manual_release.yml
@@ -30,7 +30,7 @@ jobs:
       # The tag push must authenticate as the release App: pushes made with
       # the default GITHUB_TOKEN do not trigger workflows, so release.yml
       # would never fire on the new tag.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c9a300..58779c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -171,7 +171,7 @@ jobs:
       contents: write
       pull-requests: read
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
diff --git a/.github/workflows/self_review.yml b/.github/workflows/self_review.yml
index c60d8c4..ba17b9f 100644
--- a/.github/workflows/self_review.yml
+++ b/.github/workflows/self_review.yml
@@ -68,7 +68,7 @@ jobs:
           # checkout then uses its default ref
           ref: ${{ steps.review-ref.outputs.ref }}
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.UMM_CLIENT_ID }}