diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 64972b44..87c2bd7c 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -187,7 +187,7 @@ jobs:
       # the kernel publishes a release artifact (KERNEL_LOCAL_A / download path).
       - name: Generate GitHub App token for databricks-sql-kernel
         id: kernel-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
           private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
diff --git a/.github/workflows/nightly-e2e.yml b/.github/workflows/nightly-e2e.yml
index 50210bce..9be6032c 100644
--- a/.github/workflows/nightly-e2e.yml
+++ b/.github/workflows/nightly-e2e.yml
@@ -156,7 +156,7 @@ jobs:
       # the kernel HTTPS URL to carry it (same mechanism as the go.yml kernel job).
       - name: Generate GitHub App token for databricks-sql-kernel
         id: kernel-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
           private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}