diff --git a/.changeset/app-token-client-id.md b/.changeset/app-token-client-id.md
new file mode 100644
index 0000000..a82818b
--- /dev/null
+++ b/.changeset/app-token-client-id.md
@@ -0,0 +1,4 @@
+---
+---
+
+Use `client-id` instead of the deprecated `app-id` input in CD's app-token step
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..d6fc27a
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,11 @@
+---
+# actionlint validates action inputs against a database of popular actions
+# baked in at its release. That snapshot predates create-github-app-token
+# v3.1.0, which added `client-id` and deprecated `app-id`, so it reads a
+# correct `cd.yml` as both missing a required input and using an unknown one.
+# Remove this file once an actionlint release refreshes that entry.
+paths:
+  .github/workflows/cd.yml:
+    ignore:
+      - 'input "client-id" is not defined in action'
+      - 'missing input "app-id" which is required'
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 5d2c08f..4e595c7 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -53,7 +53,9 @@ jobs:
       - id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
+          # Input rename only — `client-id` replaces the deprecated `app-id`,
+          # and the JWT `iss` claim it feeds accepts an App ID either way.
+          client-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       # `gtb version` needs node_modules (the local changeset bin + gtb itself).
diff --git a/AGENTS.md b/AGENTS.md
index 19a4b31..eb69bb1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,6 +13,7 @@ mise.lock              — Per-platform binary checksums + download URLs
 mise.tasks.toml        — Generated by `gtb sync mise`; hk:all / hk:base tasks (loaded via mise.toml's task_config.includes)
 mise.toml              — Pin dev-tool versions for local + CI; postinstall hook installs hk
 .github/
+  actionlint.yaml              — Ignores for actionlint's stale popular-actions database
   actions/
     mise-setup/          — Composite action: install + cache mise tools
     pnpm-resolve-pinned/ — Composite action: resolve locked version without install