diff --git a/.github/workflows/clientside-accept.yml b/.github/workflows/clientside-accept.yml
index 00bfabe2b..c962777f7 100644
--- a/.github/workflows/clientside-accept.yml
+++ b/.github/workflows/clientside-accept.yml
@@ -33,7 +33,7 @@ jobs:
       # exact entries a maintainer reviewed rather than re-deriving (and re-booting) them.
       - name: Extract report JSON from comment
         id: report
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs')
diff --git a/.github/workflows/clientside-report-reusable.yml b/.github/workflows/clientside-report-reusable.yml
index bf89430cb..f54274120 100644
--- a/.github/workflows/clientside-report-reusable.yml
+++ b/.github/workflows/clientside-report-reusable.yml
@@ -41,7 +41,7 @@ jobs:
       # since the caller always passes the issue number.
       - name: Resolve project link
         id: link
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const issueNumber = Number('${{ inputs.issue_number }}')
@@ -58,7 +58,7 @@ jobs:
 
       - name: Comment that no link was found
         if: steps.link.outputs.found != 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const marker = '<!-- serverpackcreator-clientside-report -->'
@@ -134,7 +134,7 @@ jobs:
 
       - name: Post report comment
         if: steps.link.outputs.found == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs')