diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
index ac6b4d988..88837bb63 100644
--- a/.github/workflows/auto-merge-dependabot.yml
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
 
       # Gets the GitHub App token
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
         id: get-app-token
         with:
           # required
diff --git a/.github/workflows/dep_update_guest_locks.yml b/.github/workflows/dep_update_guest_locks.yml
index 8e45f307e..826ae29ac 100644
--- a/.github/workflows/dep_update_guest_locks.yml
+++ b/.github/workflows/dep_update_guest_locks.yml
@@ -34,7 +34,7 @@ jobs:
       # Get GitHub App token for pushing commits back to the PR
       # Uses the same app as auto-merge-dependabot.yml
       - name: Get GitHub App token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
         id: get-app-token
         with:
           app-id: ${{ secrets.DEPENDABOT_APP_ID }}