diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cc3e94b..543b1c3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -203,7 +203,7 @@ jobs:
 
       - name: Create Homebrew tap app token
         id: create_tap_token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
         with:
           client-id: ${{ env.HOMEBREW_TAP_APP_CLIENT_ID }}
           private-key: ${{ env.HOMEBREW_TAP_APP_PRIVATE_KEY }}
diff --git a/tests/vstack/test_publish_workflow.py b/tests/vstack/test_publish_workflow.py
index d19d5b1..1474faa 100644
--- a/tests/vstack/test_publish_workflow.py
+++ b/tests/vstack/test_publish_workflow.py
@@ -54,7 +54,7 @@ def test_homebrew_job_verifies_sdist_and_dispatches_update(self) -> None:
         app_token_step = next(step for step in steps if step.get("id") == "create_tap_token")
         assert (
             app_token_step["uses"]
-            == "actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349"
+            == "actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1"
         )
         assert app_token_step["with"]["client-id"] == "${{ env.HOMEBREW_TAP_APP_CLIENT_ID }}"
         assert app_token_step["with"]["private-key"] == "${{ env.HOMEBREW_TAP_APP_PRIVATE_KEY }}"