diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..010c8b1
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,17 @@
+# actionlint bundles a snapshot of each action's inputs. Its copy of
+# actions/create-github-app-token predates the app-id -> client-id rename, so
+# it rejects the current, non-deprecated input name. v1.7.12 is the newest
+# release and still has the old set, so there is no linter bump that resolves
+# this; the suppression below is the only way to call the action without
+# tripping its runtime deprecation warning.
+#
+# Deliberately scoped to these two messages on this one file. php-tests.yml and
+# php-composer-script.yml still pass `app-id` because their credential is a
+# caller-supplied `app-id` secret rather than a Client ID, and they stay
+# covered by the normal rules. Drop this file once actionlint ships the
+# renamed input.
+paths:
+  .github/workflows/release-please-reusable.yml:
+    ignore:
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token'
+      - 'input "client-id" is not defined in action "actions/create-github-app-token'
diff --git a/.github/workflows/release-please-reusable.yml b/.github/workflows/release-please-reusable.yml
index dfac26a..2b659e1 100644
--- a/.github/workflows/release-please-reusable.yml
+++ b/.github/workflows/release-please-reusable.yml
@@ -131,11 +131,14 @@ jobs:
         if: ${{ env.APP_CLIENT_ID != '' && env.APP_PRIVATE_KEY != '' }}
         uses: actions/create-github-app-token@v3
         with:
-          # `app-id` accepts a Client ID as well; the action emits a runtime
-          # deprecation warning preferring `client-id`, but the bundled
-          # actionlint database doesn't know `client-id` yet and fails the
-          # workflow. Stay on `app-id` until actionlint catches up.
-          app-id: ${{ env.APP_CLIENT_ID }}
+          # The credential is a Client ID, so it belongs in `client-id`.
+          # `app-id` still accepts one but the action now warns on it at
+          # runtime, on every release across the org. actionlint's bundled
+          # action database predates the rename and rejects `client-id`, so
+          # `.github/actionlint.yaml` suppresses those two messages for this
+          # file alone. Drop that suppression when actionlint ships the new
+          # input set.
+          client-id: ${{ env.APP_CLIENT_ID }}
           private-key: ${{ env.APP_PRIVATE_KEY }}
 
       - name: Resolve effective token