diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e12114f..196c17d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -382,7 +382,7 @@ jobs:
             echo "::warning::OPENEIDAS_DEPLOY_APP_ID absent — pin de staging ignoré. Voir README pour créer la GitHub App dédiée."
           fi
 
-      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         if: steps.has-app.outputs.configured == 'true'
         with: