diff --git a/.github/workflows/docs-update.yml b/.github/workflows/docs-update.yml
index 6e931d233..6559b91a7 100644
--- a/.github/workflows/docs-update.yml
+++ b/.github/workflows/docs-update.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ mike-version, set-versions ]
     steps:
-    - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+    - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
diff --git a/.github/workflows/python-push.yml b/.github/workflows/python-push.yml
index d10994274..7991199aa 100644
--- a/.github/workflows/python-push.yml
+++ b/.github/workflows/python-push.yml
@@ -176,7 +176,7 @@ jobs:
       url: https://pypi.org/p/compliance-trestle
     if: github.ref == 'refs/heads/main' && github.repository == 'oscal-compass/compliance-trestle'
     steps:
-    - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+    - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
@@ -229,7 +229,7 @@ jobs:
       cancel-in-progress: true
     if: github.ref == 'refs/heads/main'
     steps:
-    - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+    - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}