diff --git a/.github/workflows/gemini-dispatch.yml b/.github/workflows/gemini-dispatch.yml
index 1a06b4c12..c8f86494f 100644
--- a/.github/workflows/gemini-dispatch.yml
+++ b/.github/workflows/gemini-dispatch.yml
@@ -84,7 +84,7 @@ jobs:
 
       - name: "Extract command"
         id: "extract_command"
-        uses: "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea" # ratchet:actions/github-script@v7
+        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v7
         env:
           EVENT_TYPE: "${{ github.event_name }}.${{ github.event.action }}"
           REQUEST:
diff --git a/.github/workflows/gemini-scheduled-triage.yml b/.github/workflows/gemini-scheduled-triage.yml
index c645663cf..6a2b52341 100644
--- a/.github/workflows/gemini-scheduled-triage.yml
+++ b/.github/workflows/gemini-scheduled-triage.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - name: "Get repository labels"
         id: "get_labels"
-        uses: "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea" # ratchet:actions/github-script@v7.0.1
+        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
         with:
           # NOTE: we intentionally do not use the minted token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -252,7 +252,7 @@ jobs:
         env:
           AVAILABLE_LABELS: "${{ needs.triage.outputs.available_labels }}"
           TRIAGED_ISSUES: "${{ needs.triage.outputs.triaged_issues }}"
-        uses: "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea" # ratchet:actions/github-script@v7.0.1
+        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.
diff --git a/.github/workflows/gemini-triage.yml b/.github/workflows/gemini-triage.yml
index 2a15deaca..013a4d9a6 100644
--- a/.github/workflows/gemini-triage.yml
+++ b/.github/workflows/gemini-triage.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: "Get repository labels"
         id: "get_labels"
-        uses: "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea" # ratchet:actions/github-script@v7.0.1
+        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
         with:
           # NOTE: we intentionally do not use the given token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -155,7 +155,7 @@ jobs:
           ISSUE_NUMBER: "${{ github.event.issue.number }}"
           AVAILABLE_LABELS: "${{ needs.triage.outputs.available_labels }}"
           SELECTED_LABELS: "${{ needs.triage.outputs.selected_labels }}"
-        uses: "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea" # ratchet:actions/github-script@v7.0.1
+        uses: "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd" # ratchet:actions/github-script@v8.0.0
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.