diff --git a/.github/workflows/dependabot.yaml b/.github/workflows/dependabot.yaml
index ecb39ef..0599cf0 100644
--- a/.github/workflows/dependabot.yaml
+++ b/.github/workflows/dependabot.yaml
@@ -15,7 +15,7 @@ jobs:
     steps:
       # The default GITHUB_TOKEN lacks the `workflows` scope and is refused on
       # PRs that touch .github/workflows; use the release app token instead.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.RELEASE_APP_ID }}