diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 3d41641f..aae98576 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ vars.SDK_BOT_APP_ID }}
           private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
diff --git a/renovate.json b/renovate.json
index fbd98c73..28f32d80 100644
--- a/renovate.json
+++ b/renovate.json
@@ -9,6 +9,13 @@
   "timezone": "UTC",
   "rebaseWhen": "conflicted",
   "packageRules": [
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "extractVersion": "^v(?<version>\\d+\\.\\d+\\.\\d+)$",
+      "groupName": "github-actions"
+    },
     {
       "matchUpdateTypes": [
         "minor",