diff --git a/.github/workflows/ci-coverage.yml b/.github/workflows/ci-coverage.yml
index 6752b7b..ecde93d 100644
--- a/.github/workflows/ci-coverage.yml
+++ b/.github/workflows/ci-coverage.yml
@@ -82,7 +82,7 @@ jobs:
 
       - name: Post coverage comment
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const pct = '${{ steps.cov.outputs.pct }}';
diff --git a/.github/workflows/ci-post-deploy-verify.yml b/.github/workflows/ci-post-deploy-verify.yml
index 4ef21f9..70a3bcf 100644
--- a/.github/workflows/ci-post-deploy-verify.yml
+++ b/.github/workflows/ci-post-deploy-verify.yml
@@ -85,7 +85,7 @@ jobs:
       - name: Find latest successful deploy run
         id: find-run
         if: github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { data } = await github.rest.actions.listWorkflowRuns({
@@ -206,7 +206,7 @@ jobs:
 
     steps:
       - name: Create alert issue on nightly failure
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;