diff --git a/.github/workflows/flux-diff.yaml b/.github/workflows/flux-diff.yaml
index 9594aec66..2104968fa 100644
--- a/.github/workflows/flux-diff.yaml
+++ b/.github/workflows/flux-diff.yaml
@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
diff --git a/.github/workflows/flux-image-test.yaml b/.github/workflows/flux-image-test.yaml
index 4d41549e9..045db2bf8 100644
--- a/.github/workflows/flux-image-test.yaml
+++ b/.github/workflows/flux-image-test.yaml
@@ -21,7 +21,7 @@ jobs:
       matrix: ${{ steps.extract-images.outputs.images }}
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 7296cf1d4..45d20a729 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
diff --git a/.github/workflows/labels-sync.yaml b/.github/workflows/labels-sync.yaml
index af5b81e23..34210dcdf 100644
--- a/.github/workflows/labels-sync.yaml
+++ b/.github/workflows/labels-sync.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
diff --git a/.github/workflows/lychee.yaml b/.github/workflows/lychee.yaml
index f7bc9ea8a..ed92badef 100644
--- a/.github/workflows/lychee.yaml
+++ b/.github/workflows/lychee.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index a08205a24..1f23aca47 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"