diff --git a/.github/workflows/remote-cache-deploy.yml b/.github/workflows/remote-cache-deploy.yml
index 98e801c..85275dc 100644
--- a/.github/workflows/remote-cache-deploy.yml
+++ b/.github/workflows/remote-cache-deploy.yml
@@ -39,7 +39,7 @@ jobs:
         if: >-
           always() && github.event_name == 'pull_request' &&
           (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             await core.summary.addHeading('Remote cache staging').addRaw(
@@ -67,7 +67,7 @@ jobs:
     steps:
       - name: Check that the PR still selects this commit
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: context.issue.number });
@@ -110,7 +110,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         env:
           DEPLOY_RESULT: ${{ needs.deploy.result }}
           CHECK_RESULT: ${{ needs.check.result }}