diff --git a/.github/workflows/release-reminders.yaml b/.github/workflows/release-reminders.yaml
index f23da2f..b79dbfc 100644
--- a/.github/workflows/release-reminders.yaml
+++ b/.github/workflows/release-reminders.yaml
@@ -13,7 +13,7 @@ jobs:
 
       - name: Generate token from GitHub App
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           # The client id is public app metadata, not a secret, so it is
           # written here rather than kept alongside the private key. app-id
diff --git a/.github/workflows/update-stats.yaml b/.github/workflows/update-stats.yaml
index f2a02e0..cd083a0 100644
--- a/.github/workflows/update-stats.yaml
+++ b/.github/workflows/update-stats.yaml
@@ -17,7 +17,7 @@ jobs:
       # is used by release-reminders.yaml.
       - name: Generate token from GitHub App
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           # The client id is public app metadata, not a secret like the key
           # below, so it is written here rather than stored alongside it.