diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index a7adc0d6c5ab..c1f396c8b91c 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index 1b0336cf05de..c496465885b9 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -56,7 +56,7 @@ jobs:
         run: npm install @actions/artifact@5.0.3 bottleneck@2.19.5
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 50d9ad694984..2156342ee536 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -53,7 +53,7 @@ jobs:
       - name: Install dependencies
         run: npm install bottleneck@2.19.5
 
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
         id: app-token
         with:
@@ -102,7 +102,7 @@ jobs:
           sparse-checkout: |
             ci/github-script
 
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_MANUAL_EDIT_CHECK_CLIENT_ID
         id: app-token
         with:
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 661f42fb130c..c684865dc369 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -30,7 +30,7 @@ jobs:
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/edited.yml b/.github/workflows/edited.yml
index 49fda6911533..d2fc40ec9830 100644
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@@ -36,7 +36,7 @@ jobs:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
       # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 7ea55dd013da..dbb7be399198 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -354,7 +354,7 @@ jobs:
               target_url
             })
 
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name == 'pull_request_target' && vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
         id: app-token
         with:
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 243abce607f8..4b10d88a59a5 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index 88ed0a9b5f1d..01d5691a6773 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -45,7 +45,7 @@ jobs:
 
       # It's fine to reuse this app in the 'eval / compare' job,
       # because this job has to run before that one.
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
         id: app-token
         with:
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 63e2b840e622..ecdd8732f522 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -27,7 +27,7 @@ jobs:
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index 6fb059eeab67..32a8808ba797 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered and to
       # request team member lists.
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}