diff --git a/.github/workflows/auto_updates.yml b/.github/workflows/auto_updates.yml
index cbbc3342..65dbafc6 100644
--- a/.github/workflows/auto_updates.yml
+++ b/.github/workflows/auto_updates.yml
@@ -48,7 +48,7 @@ jobs:
         # The PR may already exist (e.g., created in previous week and not merged yet) so we
         # allow it here and check in the next step so workflow failures will be extraordinary
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GH_RELEASE_PAT }}
           script: |
diff --git a/.github/workflows/update_submodule.yml b/.github/workflows/update_submodule.yml
index 13567915..3d4d3ca6 100644
--- a/.github/workflows/update_submodule.yml
+++ b/.github/workflows/update_submodule.yml
@@ -56,7 +56,7 @@ jobs:
           git push --force origin "HEAD:update-${REPO_NAME}-submodule"
 
       - name: Create Pull Request
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GH_RELEASE_PAT }}
           script: |