diff --git a/.github/workflows/cert-pin-watch.yml b/.github/workflows/cert-pin-watch.yml
index b54bdb6..b94b125 100644
--- a/.github/workflows/cert-pin-watch.yml
+++ b/.github/workflows/cert-pin-watch.yml
@@ -68,7 +68,7 @@ jobs:
 
     - name: Open a tracking issue on drift
       if: failure()
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       env:
         # Passed via env (not ${{ }} interpolation) so the report text can
         # never break out of the script — workflow-injection-safe pattern.