diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e70436f..84e1dc1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
         run: pnpm dlx @ryanccn/sarif-strip-suppressed /tmp/lint.sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # ratchet:github/codeql-action/upload-sarif@v4.38.0
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # ratchet:github/codeql-action/upload-sarif@v4.38.2
         with:
           sarif_file: /tmp/lint.sarif
           wait-for-processing: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 17efec3..269f30e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # ratchet:github/codeql-action/init@v4.38.0
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # ratchet:github/codeql-action/init@v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # ratchet:github/codeql-action/analyze@v4.38.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # ratchet:github/codeql-action/analyze@v4.38.2