@@ -9,6 +9,7 @@ workflows:
         - 'github/setup-goproxy@v1.1.0'
     '.github/workflows/relock.yml':
         - 'actions/checkout@v6.0.2'
+        - 'github/gh-actions-lock@main'
     '.github/workflows/sync-early-access-release.yml':
         - 'actions/checkout@v6.0.2'
     '.github/workflows/test.yml':
@@ -65,7 +66,7 @@ dependencies:
             - 'actions/setup-go@v5'
     'github/gh-actions-lock@main':
         ref: 'main'
-        commit: 'sha1-419a59e0d36ec15d649200df42e3092fa0c117b7'
+        commit: 'sha1-da8ddbe47a719ba4dd60cde61bb96c4301b98e61'
         owner_id: 9919
         repo_id: 1217640442
     'github/setup-goproxy@v1.1.0':
 
@@ -9,11 +9,7 @@ inputs:
   ignore-categories:
     description: Comma-separated finding categories to treat as warnings instead of errors (e.g. "local-action")
     required: false
-    default: ""
-  token:
-    description: GitHub token used by gh actions-lock for API calls. Defaults to github.token.
-    required: false
-    default: ${{ github.token }}
+    default: "self-hosted-runner"
 
 runs:
   using: composite
@@ -35,4 +31,4 @@ runs:
       shell: bash
       run: ${{ github.action_path }}/../../script/lockfile-lint.sh "$RUNNER_TEMP/gh-actions-lock" "${{ inputs.ignore-categories }}" ${{ inputs.extra-flags }}
       env:
-        GH_TOKEN: ${{ inputs.token }}
+        GH_TOKEN: ${{ github.token }}
@@ -0,0 +1,44 @@
+name: Relock actions.lock
+description: Relock the actions.lock file after dependency updates (e.g. Dependabot PRs)
+
+inputs:
+  extra-flags:
+    description: Extra flags passed to gh actions-lock (e.g. "--allow-runners foo")
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: OIDC Setup for goproxy
+      uses: github/setup-goproxy@v1.1.0
+
+    - uses: actions/setup-go@v5
+      with:
+        go-version-file: ${{ github.action_path }}/../../go.mod
+
+    - name: Build gh-actions-lock
+      shell: bash
+      run: |
+        cd "${{ github.action_path }}/../.."
+        go build -o "$RUNNER_TEMP/gh-actions-lock" ./cmd/gh-actions-lock
+
+    - name: Relock
+      shell: bash
+      run: |
+        "$RUNNER_TEMP/gh-actions-lock" --no-onboard --no-interactive -A ${{ inputs.extra-flags }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+    - name: Commit updated lockfile
+      shell: bash
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add .github/workflows/actions.lock
+        if git diff --cached --quiet; then
+          echo "Lockfile already up to date"
+        else
+          git commit -m "Relock actions.lock after dependency update"
+          git push
+        fi