diff --git a/.github/workflows/agent-team-apply-verify.yml b/.github/workflows/agent-team-apply-verify.yml
index 9caaea0..80845bc 100644
--- a/.github/workflows/agent-team-apply-verify.yml
+++ b/.github/workflows/agent-team-apply-verify.yml
@@ -1201,7 +1201,7 @@ jobs:
         # itself is already held at the agent-apply environment's required-reviewer
         # gate, so this never runs unapproved.
         if: ${{ steps.gate.outputs.gate == 'pass' }}
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           # PROVISIONING: create the GitHub App (single permission:
           # `pull-requests: write`), install it on the target repo, and store