diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 013f0ebb..d984de5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -314,7 +314,7 @@ jobs:
         run: cargo run --locked -- scan .. --core "$(cd ../core && cabal list-bin ce-core)" --format sarif > ../ce-scan.sarif
       - name: SARIF upload (publish)
         if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9, pinned 2026-09-06 (dependabot #7)
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0, pinned 2026-09-12 (dependabot #12)
         with:
           sarif_file: ce-scan.sarif
           category: ce-scan
@@ -329,7 +329,7 @@ jobs:
         run: cargo run --locked -- dedup .. --core "$(cd ../core && cabal list-bin ce-core)" --format sarif > ../ce-dedup.sarif
       - name: SARIF upload (dedup publish)
         if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9, pinned 2026-09-06 (dependabot #7)
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0, pinned 2026-09-12 (dependabot #12)
         with:
           sarif_file: ce-dedup.sarif
           category: ce-dedup