diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 63323c0..145596d 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -44,7 +44,7 @@ jobs:
           app-id: ${{ secrets.ALFHEIM_AGENT_APP_ID }}
           private-key: ${{ secrets.ALFHEIM_AGENT_PRIVATE_KEY }}
 
-      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7.0.1
         with:
           # App token when available (→ alfheim-agent[bot]); else the default
           # GITHUB_TOKEN (→ github-actions[bot]). Either way the logic is identical.