diff --git a/.github/workflows/boring-open-awslc-bump.yml b/.github/workflows/boring-open-awslc-bump.yml
index bef359b6ee09..e4f5b1f7edd5 100644
--- a/.github/workflows/boring-open-awslc-bump.yml
+++ b/.github/workflows/boring-open-awslc-bump.yml
@@ -53,11 +53,11 @@ jobs:
             --tag-pattern 'v[0-9\.]*'
       - name: Check for updates
         run: git status
-      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: generate-token
         with:
-          app_id: ${{ secrets.BORINGBOT_APP_ID }}
-          private_key: ${{ secrets.BORINGBOT_PRIVATE_KEY }}
+          app-id: ${{ secrets.BORINGBOT_APP_ID }}
+          private-key: ${{ secrets.BORINGBOT_PRIVATE_KEY }}
         if: steps.bump-boringssl.outputs.HAS_UPDATES == 'true' || steps.bump-openssl.outputs.HAS_UPDATES == 'true' || steps.bump-awslc.outputs.HAS_UPDATES == 'true'
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
diff --git a/.github/workflows/downstream-version-bump.yml b/.github/workflows/downstream-version-bump.yml
index 7554a23ef822..94b5a23576be 100644
--- a/.github/workflows/downstream-version-bump.yml
+++ b/.github/workflows/downstream-version-bump.yml
@@ -20,11 +20,11 @@ jobs:
       - name: Parse downstream dependencies
         id: downstream-bump
         run: ./.github/bin/bump_downstreams.sh
-      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: generate-token
         with:
-          app_id: ${{ secrets.BORINGBOT_APP_ID }}
-          private_key: ${{ secrets.BORINGBOT_PRIVATE_KEY }}
+          app-id: ${{ secrets.BORINGBOT_APP_ID }}
+          private-key: ${{ secrets.BORINGBOT_PRIVATE_KEY }}
         if: steps.downstream-bump.outputs.HAS_UPDATES == 'true'
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
diff --git a/.github/workflows/x509-limbo-version-bump.yml b/.github/workflows/x509-limbo-version-bump.yml
index cc3dd182713b..1f2a7206f8be 100644
--- a/.github/workflows/x509-limbo-version-bump.yml
+++ b/.github/workflows/x509-limbo-version-bump.yml
@@ -39,11 +39,11 @@ jobs:
             --comment-pattern 'Latest commit on the wycheproof main branch.*?\.'
       - name: Check for updates
         run: git status
-      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: generate-token
         with:
-          app_id: ${{ secrets.BORINGBOT_APP_ID }}
-          private_key: ${{ secrets.BORINGBOT_PRIVATE_KEY }}
+          app-id: ${{ secrets.BORINGBOT_APP_ID }}
+          private-key: ${{ secrets.BORINGBOT_PRIVATE_KEY }}
         if: steps.bump-x509-limbo.outputs.HAS_UPDATES == 'true' || steps.bump-wycheproof.outputs.HAS_UPDATES == 'true'
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1