diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 849662b..ebb117f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,10 +32,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/security-deps.yml b/.github/workflows/security-deps.yml
index e8377b9..e440e41 100644
--- a/.github/workflows/security-deps.yml
+++ b/.github/workflows/security-deps.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Upload osv SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: osv-results.sarif
           category: osv-scanner
diff --git a/.github/workflows/security-sast.yml b/.github/workflows/security-sast.yml
index 6f4d263..eaa0ee4 100644
--- a/.github/workflows/security-sast.yml
+++ b/.github/workflows/security-sast.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload semgrep SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: semgrep-results.sarif
           category: semgrep
diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml
index ed3aa1e..6a79aa8 100644
--- a/.github/workflows/security-scorecard.yml
+++ b/.github/workflows/security-scorecard.yml
@@ -52,6 +52,6 @@ jobs:
               )
             )
           ' scorecard-results.sarif > scorecard-results.code-scanning.sarif
-      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: scorecard-results.code-scanning.sarif
diff --git a/.github/workflows/security-secrets.yml b/.github/workflows/security-secrets.yml
index 1ae17e2..99bb483 100644
--- a/.github/workflows/security-secrets.yml
+++ b/.github/workflows/security-secrets.yml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Upload SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: gitleaks-results.sarif
           category: gitleaks