diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 24d90ff..13efeb9 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -42,7 +42,7 @@ jobs:
         if: always()
         # Fork PRs get a read-only token; the summary is best-effort.
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs')
@@ -116,7 +116,7 @@ jobs:
         if: always()
         # Fork PRs get a read-only token; the summary is best-effort.
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs')
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 5b41474..6ab6031 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -68,7 +68,7 @@ jobs:
       - name: Comment PR with preview URL
         if: github.event_name == 'pull_request' && env.HAS_VERCEL_TOKEN == 'true'
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.createComment({