diff --git a/.github/workflows/game-versions.yml b/.github/workflows/game-versions.yml
index 91a1212..a9fc0a4 100644
--- a/.github/workflows/game-versions.yml
+++ b/.github/workflows/game-versions.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Only the org App may write to the default branch unattended.
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.INDEX_APP_ID }}
diff --git a/.github/workflows/watcher.yml b/.github/workflows/watcher.yml
index 8ccc467..bc1958d 100644
--- a/.github/workflows/watcher.yml
+++ b/.github/workflows/watcher.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       # The one identity with access to both halves of the index, and the only
       # actor the branch protection ruleset lets write here unattended.
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.INDEX_APP_ID }}