diff --git a/.github/workflows/api-ci-cd.yml b/.github/workflows/api-ci-cd.yml
index 7d4a915..c66d9ab 100644
--- a/.github/workflows/api-ci-cd.yml
+++ b/.github/workflows/api-ci-cd.yml
@@ -140,7 +140,7 @@ jobs:
           path: ./publish
 
       - name: Azure login
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_566B4FFECC144FF99662F3E334946913 }}
           tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_666F8329ACAC4EF9A4E3DFE024EB99CA }}
diff --git a/.github/workflows/provision-plan.yml b/.github/workflows/provision-plan.yml
index a6686ea..c8d375b 100644
--- a/.github/workflows/provision-plan.yml
+++ b/.github/workflows/provision-plan.yml
@@ -72,7 +72,7 @@ jobs:
       # whole point: the defect this job exists to catch is invisible to a human running the
       # script locally, because `az ad signed-in-user show` answers for a human and not for CI.
       - name: Azure login (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_566B4FFECC144FF99662F3E334946913 }}
           tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_666F8329ACAC4EF9A4E3DFE024EB99CA }}