diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
deleted file mode 100644
index 010c8b1..0000000
--- a/.github/actionlint.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# actionlint bundles a snapshot of each action's inputs. Its copy of
-# actions/create-github-app-token predates the app-id -> client-id rename, so
-# it rejects the current, non-deprecated input name. v1.7.12 is the newest
-# release and still has the old set, so there is no linter bump that resolves
-# this; the suppression below is the only way to call the action without
-# tripping its runtime deprecation warning.
-#
-# Deliberately scoped to these two messages on this one file. php-tests.yml and
-# php-composer-script.yml still pass `app-id` because their credential is a
-# caller-supplied `app-id` secret rather than a Client ID, and they stay
-# covered by the normal rules. Drop this file once actionlint ships the
-# renamed input.
-paths:
-  .github/workflows/release-please-reusable.yml:
-    ignore:
-      - 'missing input "app-id" which is required by action "actions/create-github-app-token'
-      - 'input "client-id" is not defined in action "actions/create-github-app-token'
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 6d51e1e..7b6c579 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -50,4 +50,4 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Run actionlint
-        uses: rhysd/actionlint@v1.7.12
+        uses: openCoreEMR/actionlint@v1.7.12-oce.1
diff --git a/.github/workflows/php-composer-script.yml b/.github/workflows/php-composer-script.yml
index cfb29b8..1ed6ab1 100644
--- a/.github/workflows/php-composer-script.yml
+++ b/.github/workflows/php-composer-script.yml
@@ -90,7 +90,7 @@ on:
         default: ubuntu-latest
     secrets:
       app-id:
-        description: GitHub App ID for private-repos auth
+        description: GitHub App Client ID for private-repos auth
         required: false
       app-private-key:
         description: GitHub App private key for private-repos auth
@@ -111,7 +111,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.app-id }}
+          client-id: ${{ secrets.app-id }}
           private-key: ${{ secrets.app-private-key }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ inputs.private-repos }}
diff --git a/.github/workflows/php-tests.yml b/.github/workflows/php-tests.yml
index 1dc48c9..371e8ef 100644
--- a/.github/workflows/php-tests.yml
+++ b/.github/workflows/php-tests.yml
@@ -111,7 +111,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.app-id }}
+          client-id: ${{ secrets.app-id }}
           private-key: ${{ secrets.app-private-key }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ inputs.private-repos }}
diff --git a/.github/workflows/release-please-reusable.yml b/.github/workflows/release-please-reusable.yml
index 2b659e1..17aec33 100644
--- a/.github/workflows/release-please-reusable.yml
+++ b/.github/workflows/release-please-reusable.yml
@@ -131,13 +131,6 @@ jobs:
         if: ${{ env.APP_CLIENT_ID != '' && env.APP_PRIVATE_KEY != '' }}
         uses: actions/create-github-app-token@v3
         with:
-          # The credential is a Client ID, so it belongs in `client-id`.
-          # `app-id` still accepts one but the action now warns on it at
-          # runtime, on every release across the org. actionlint's bundled
-          # action database predates the rename and rejects `client-id`, so
-          # `.github/actionlint.yaml` suppresses those two messages for this
-          # file alone. Drop that suppression when actionlint ships the new
-          # input set.
           client-id: ${{ env.APP_CLIENT_ID }}
           private-key: ${{ env.APP_PRIVATE_KEY }}