diff --git a/.github/workflows/codeql-fork-upload.yml b/.github/workflows/codeql-fork-upload.yml
index 55bf710904..1794cc7186 100644
--- a/.github/workflows/codeql-fork-upload.yml
+++ b/.github/workflows/codeql-fork-upload.yml
@@ -81,7 +81,7 @@ jobs:
             core.setOutput("sha", headSha);
 
       - name: Upload CodeQL results to the pull request
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: ${{ runner.temp }}/codeql-sarif
           ref: refs/pull/${{ steps.pr.outputs.number }}/head
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a28588ea64..e729689dde 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -74,7 +74,7 @@ jobs:
           ref: ${{ env.IS_FORK_PR == 'true' && github.event.pull_request.head.sha || github.ref }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -89,7 +89,7 @@ jobs:
           # rule from the branch ruleset.
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: "/language:${{ matrix.language }}"
           # Push and internal-branch PRs have a write token and upload directly.
diff --git a/.github/workflows/docs-pr-amend.yml b/.github/workflows/docs-pr-amend.yml
index ea495e6792..059a2a7cbe 100644
--- a/.github/workflows/docs-pr-amend.yml
+++ b/.github/workflows/docs-pr-amend.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Generate app token
         id: app-token
         if: env.HAS_APP_CREDS == 'true'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/docs-refresh.yml b/.github/workflows/docs-refresh.yml
index f3da893d9f..2824fcedb9 100644
--- a/.github/workflows/docs-refresh.yml
+++ b/.github/workflows/docs-refresh.yml
@@ -202,7 +202,7 @@ jobs:
       - name: Generate TypeAgent-Bot token
         id: app-token
         if: ${{ steps.detect.outputs.changes == 'true' }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/fix-dependabot-alerts.yml b/.github/workflows/fix-dependabot-alerts.yml
index c95503afe7..fed14262c0 100644
--- a/.github/workflows/fix-dependabot-alerts.yml
+++ b/.github/workflows/fix-dependabot-alerts.yml
@@ -62,7 +62,7 @@ jobs:
 
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
@@ -624,7 +624,7 @@ jobs:
       - name: Refresh GitHub App token
         id: app-token-pr
         if: ${{ steps.fix.outputs.changes == 'true' && steps.build.outputs.build_ok == 'true' }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/format-pr.yml b/.github/workflows/format-pr.yml
index 88382d1a9e..5f059f7365 100644
--- a/.github/workflows/format-pr.yml
+++ b/.github/workflows/format-pr.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Generate app token
         id: app-token
         if: env.HAS_APP_CREDS == 'true'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/heal-generated-files-finalize.yml b/.github/workflows/heal-generated-files-finalize.yml
index c77cd6d28d..fdd8f4703e 100644
--- a/.github/workflows/heal-generated-files-finalize.yml
+++ b/.github/workflows/heal-generated-files-finalize.yml
@@ -157,7 +157,7 @@ jobs:
       - name: Mint minimally scoped App token
         id: app-token
         if: steps.verify.outputs.candidate_count != '0'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}