diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index b08714a31f12..26c51427c164 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index 6366f666de13..0b58d1919ef5 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -56,7 +56,7 @@ jobs:
         run: npm install @actions/artifact bottleneck
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index d09df6956c8c..f94d3a6ec4ae 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -30,7 +30,7 @@ jobs:
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/edited.yml b/.github/workflows/edited.yml
index 058c6181e2a6..8e9d471eaa13 100644
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@@ -36,7 +36,7 @@ jobs:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
       # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 606c03866e6f..c9bdfc16d500 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 44ac3f0088d4..fc3f8381589d 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -27,7 +27,7 @@ jobs:
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index cca0ca1f65da..c421cb2b3fd1 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered and to
       # request team member lists.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}