diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 4965805..86c4f7e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ jobs:
       # A short-lived installation token of the org-owned "Palasthotel Release
       # Bot" app. Needed instead of GITHUB_TOKEN because the tag this job
       # pushes has to trigger wordpress-svn-release.yml.
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.RELEASE_BOT_APP_ID }}
diff --git a/.github/workflows/update-plugin-version.yml b/.github/workflows/update-plugin-version.yml
index c299ac2..c35072d 100644
--- a/.github/workflows/update-plugin-version.yml
+++ b/.github/workflows/update-plugin-version.yml
@@ -21,7 +21,7 @@ jobs:
       # Pushing with the app token (instead of GITHUB_TOKEN) re-triggers the PR
       # checks on the new head commit — GITHUB_TOKEN pushes trigger nothing,
       # which would leave the release PR without check results.
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.RELEASE_BOT_APP_ID }}