diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000..3d3818eb
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,9 @@
+# Workaround for stale bundled metadata for actions/create-github-app-token.
+# actionlint ships pre-v3.1.0 inputs, so it wrongly rejects `client-id` and
+# demands the now-deprecated `app-id`. Remove once the fix lands upstream:
+# https://github.com/rhysd/actionlint/pull/652
+paths:
+  .github/workflows/*.{yml,yaml}:
+    ignore:
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token@[^"]+"'
+      - 'input "client-id" is not defined in action "actions/create-github-app-token@[^"]+"'
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index c602f7ba..4d65d48a 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -5,12 +5,14 @@ on:
     branches:
       - master
     paths:
+      - '.github/actionlint.yaml'
       - '.github/actions/**'
       - '.github/workflows/**'
   pull_request:
     branches:
       - master
     paths:
+      - '.github/actionlint.yaml'
       - '.github/actions/**'
       - '.github/workflows/**'