diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3f670c24..635a2794 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -78,7 +78,7 @@ jobs:
       # in bulk here on deliberate design rather than on defects are filtered
       # in the config file, each with its measured count and the reasoning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: csharp
           build-mode: manual
@@ -100,7 +100,7 @@ jobs:
         run: dotnet build "hmailserver/source/Tools/hMailServer Tools.sln" -c Release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:csharp"
           upload: never
@@ -142,7 +142,7 @@ jobs:
               json.dump(sarif, f)
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: sarif-results/csharp.sarif
           category: "/language:csharp"
@@ -212,7 +212,7 @@ jobs:
       # is triaged, moving this to security-and-quality is a one-word change -
       # but do it from a measured count, not on principle.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: c-cpp
           build-mode: manual
@@ -230,7 +230,7 @@ jobs:
         run: ./build/build.ps1 -Configuration $env:BUILD_CONFIGURATION -Clean
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:c-cpp"
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 1ec57118..f90a518c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -74,7 +74,7 @@ jobs:
           publish_results: false
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: scorecard-results.sarif