diff --git a/.github/workflows/branch.yml b/.github/workflows/branch.yml
index b6a9a5e..8306d9d 100644
--- a/.github/workflows/branch.yml
+++ b/.github/workflows/branch.yml
@@ -20,7 +20,7 @@ jobs:
       # NOTE - this doesn't currently work if the PR is coming from a fork, due to limitations in GitHub actions secrets
       - name: Post PR comment
         if: failure()
-        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
+        uses: mshick/add-pr-comment@ffd016c7e151d97d69d21a843022fd4cd5b96fe5 # v3.9.0
         with:
           message: |
             ## This PR is against the `main` branch :x: