diff --git a/.github/workflows/dms-stable.yml b/.github/workflows/dms-stable.yml
index 63bb76ba6..2af3c3f5c 100644
--- a/.github/workflows/dms-stable.yml
+++ b/.github/workflows/dms-stable.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -51,7 +51,7 @@ jobs:
     steps:
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/point-release.yml b/.github/workflows/point-release.yml
index fceeec9c9..59fa8de36 100644
--- a/.github/workflows/point-release.yml
+++ b/.github/workflows/point-release.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/port.yml b/.github/workflows/port.yml
index e74aaf11f..563d34e2a 100644
--- a/.github/workflows/port.yml
+++ b/.github/workflows/port.yml
@@ -15,29 +15,32 @@ permissions:
   contents: write
   issues: write
 
+concurrency:
+  group: port-engine
+  cancel-in-progress: false
+
 jobs:
-  trailer:
-    name: Port trailer-flagged commits
-    if: github.event_name == 'push'
+  port:
+    name: Port flagged commits
     runs-on: ubuntu-latest
-    concurrency:
-      group: port-engine
-      cancel-in-progress: false
     steps:
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
+      # Base-repo code only; PR head code is never checked out or executed.
       - name: Checkout
         uses: actions/checkout@v6
         with:
+          ref: master
           fetch-depth: 0
           token: ${{ steps.app_token.outputs.token }}
 
-      - name: Port flagged commits
+      - name: Port trailer-flagged commits
+        if: github.event_name == 'push'
         env:
           GH_TOKEN: ${{ steps.app_token.outputs.token }}
           COMMITS: ${{ toJSON(github.event.commits) }}
@@ -61,34 +64,12 @@ jobs:
             done
           done
 
-  label:
-    name: Port label-flagged PR
-    if: >
-      github.event_name == 'pull_request_target' &&
-      github.event.pull_request.merged == true &&
-      (github.event.action == 'closed' ||
-       (github.event.action == 'labeled' && startsWith(github.event.label.name, 'port ')))
-    runs-on: ubuntu-latest
-    concurrency:
-      group: port-engine
-      cancel-in-progress: false
-    steps:
-      - name: Create GitHub App token
-        id: app_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      # Base-repo code only; PR head code is never checked out or executed.
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: master
-          fetch-depth: 0
-          token: ${{ steps.app_token.outputs.token }}
-
-      - name: Port merge commit
+      - name: Port label-flagged PR
+        if: >
+          github.event_name == 'pull_request_target' &&
+          github.event.pull_request.merged == true &&
+          (github.event.action == 'closed' ||
+           (github.event.action == 'labeled' && startsWith(github.event.label.name, 'port ')))
         env:
           GH_TOKEN: ${{ steps.app_token.outputs.token }}
           LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
diff --git a/.github/workflows/update-vendor-hash.yml b/.github/workflows/update-vendor-hash.yml
index 77d3a751a..7617f16d9 100644
--- a/.github/workflows/update-vendor-hash.yml
+++ b/.github/workflows/update-vendor-hash.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}