diff --git a/.github/workflows/envoy-sync.yaml b/.github/workflows/envoy-sync.yaml
index 2a57a3e..60a34a2 100644
--- a/.github/workflows/envoy-sync.yaml
+++ b/.github/workflows/envoy-sync.yaml
@@ -23,7 +23,7 @@ jobs:
       }}
     steps:
     - id: appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@8a8f4f64d8bccc99427740197479c0a5353ca8de  # actions-v0.0.18
+      uses: envoyproxy/toolshed/actions/appauth@598eacce15ab5f208102a2fd5669292868002701  # actions-v0.4.0
       with:
         key: ${{ secrets.ENVOY_CI_UPDATE_BOT_KEY }}
         app_id: ${{ secrets.ENVOY_CI_UPDATE_APP_ID }}
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 545d8ff..067a1c8 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -34,7 +34,7 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
 
-    - uses: envoyproxy/toolshed/gh-actions/gcp/setup@actions-v0.3.14
+    - uses: envoyproxy/toolshed/actions/gcp/setup@598eacce15ab5f208102a2fd5669292868002701  # actions-v0.4.0
       name: Setup GCP (cache)
       if: ${{ github.event_name != 'pull_request' }}
       with: