diff --git a/.github/workflows/post-publish-verification.yml b/.github/workflows/post-publish-verification.yml
index efe4d08..20e4016 100644
--- a/.github/workflows/post-publish-verification.yml
+++ b/.github/workflows/post-publish-verification.yml
@@ -197,7 +197,7 @@ jobs:
       # Upload SARIF results to GitHub Security
       - name: upload trivy image SARIF
         if: always() && steps.trivy-image.outcome != 'skipped'
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: trivy-sarif
           category: trivy-published-images
diff --git a/.github/workflows/security-scan-artifacts.yml b/.github/workflows/security-scan-artifacts.yml
index 6519345..108ff95 100644
--- a/.github/workflows/security-scan-artifacts.yml
+++ b/.github/workflows/security-scan-artifacts.yml
@@ -99,7 +99,7 @@ jobs:
 
       - name: upload trivy fs SARIF
         if: always() && steps.trivy-fs.outcome != 'skipped'
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: "trivy-fs-results.sarif"
           category: "trivy-filesystem"
@@ -119,7 +119,7 @@ jobs:
 
       - name: upload grype SARIF
         if: always() && steps.grype.outcome != 'skipped'
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: ${{ steps.grype.outputs.sarif }}
           category: "grype"
@@ -262,7 +262,7 @@ jobs:
 
       - name: upload docker trivy SARIF
         if: always() && steps.docker-scan.outcome != 'skipped'
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: trivy-sarif
           category: trivy-docker-pre-publish
diff --git a/.github/workflows/security-scan-source.yml b/.github/workflows/security-scan-source.yml
index e8cd389..db1468c 100644
--- a/.github/workflows/security-scan-source.yml
+++ b/.github/workflows/security-scan-source.yml
@@ -198,7 +198,7 @@ jobs:
 
       - name: upload semgrep SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: semgrep.sarif
         continue-on-error: true
@@ -326,15 +326,15 @@ jobs:
           persist-credentials: false
 
       - name: initialize codeql
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: autobuild
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: perform codeql analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: ${{ inputs.codeql_category != '' && inputs.codeql_category || format('/language:{0}', matrix.language) }}