diff --git a/.github/workflows/build-container-bake.yml b/.github/workflows/build-container-bake.yml
index ad1fb7b..d77db9c 100644
--- a/.github/workflows/build-container-bake.yml
+++ b/.github/workflows/build-container-bake.yml
@@ -608,7 +608,7 @@ jobs:
           && github.event_name != 'merge_group'
           && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
           && steps.trivy.outputs.count != '0'
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           # No `category` here: each SARIF carries its own distinct category
           # (automationDetails.id set in the scan step) so multi-target scans
diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
index 1528a9d..7defc62 100644
--- a/.github/workflows/build-container.yml
+++ b/.github/workflows/build-container.yml
@@ -353,7 +353,7 @@ jobs:
           && github.event_name != 'merge_group'
           && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
           && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: "trivy-results.sarif"
           category: "container-scan"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6a6cb17..58d45a1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -190,7 +190,7 @@ jobs:
       # analysis produced was clear-text logging of a credential in a Playwright
       # login helper — test code leaks into CI logs like any other code.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
@@ -214,7 +214,7 @@ jobs:
         run: bash -euo pipefail -c "$PRE_BUILD_CMD"
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}
           # On `merge_group` the analysis runs but its result is not uploaded.
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index 53053f5..258d05a 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -82,7 +82,7 @@ jobs:
 
       - name: Upload SARIF to code scanning
         if: always() && hashFiles('betterleaks.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: betterleaks.sarif
           category: betterleaks
diff --git a/.github/workflows/go-check.yml b/.github/workflows/go-check.yml
index 2a58c3d..0f4aa25 100644
--- a/.github/workflows/go-check.yml
+++ b/.github/workflows/go-check.yml
@@ -537,7 +537,7 @@ jobs:
         # failure on every successful merge. Push and pull_request events
         # re-run the same scan with a stable ref, so coverage is not lost.
         if: always() && github.event_name != 'merge_group' && hashFiles('gosec-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: gosec-results.sarif
 
diff --git a/.github/workflows/release-go-app.yml b/.github/workflows/release-go-app.yml
index e5824ba..4e6665f 100644
--- a/.github/workflows/release-go-app.yml
+++ b/.github/workflows/release-go-app.yml
@@ -637,7 +637,7 @@ jobs:
         # and producing a guaranteed `ref ... not found` failure. Release/push
         # events run with stable refs.
         if: github.event_name != 'merge_group' && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-results.sarif
           category: container-scan
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ffd76a0..5881a97 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,6 +59,6 @@ jobs:
         # and producing a guaranteed `ref ... not found` failure. Push and
         # schedule events run with stable refs.
         if: github.event_name != 'merge_group'
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security-container.yml b/.github/workflows/security-container.yml
index 58cf03d..05ead99 100644
--- a/.github/workflows/security-container.yml
+++ b/.github/workflows/security-container.yml
@@ -198,7 +198,7 @@ jobs:
         # the moment the merge completes, racing with codeql-action/upload-sarif
         # and producing a guaranteed `ref ... not found` failure.
         if: always() && inputs.upload-sarif && github.event_name != 'merge_group' && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-results.sarif
           category: ${{ inputs.sarif-category }}