diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json
index f7e9b4b..163d7fe 100644
--- a/.github/workflow-policy.json
+++ b/.github/workflow-policy.json
@@ -6,7 +6,7 @@
     ".github/workflows/cla-dco.yml": "6a931f46518dd3d7a149ca963a2aa5124ca184a746b191889f1d28c4cf4555f7",
     ".github/workflows/license.yml": "d8032e889057a6e760c080e6adb10942ed59b8abd45f92951b956a95b79733df",
     ".github/workflows/release-provenance.yml": "a6e44d232964d23f32777da25f5255b20d0db1fbcb3cc18418f0c11b3042d11e",
-    ".github/workflows/security.yml": "8e2210f0caa813ef886ba353d8d3c395f0033e047eb9299d314b27de99bfb4a7",
-    ".github/workflows/supply-chain.yml": "3c8a128ed0f1e8c04e4e5d2ffc2b589927c7b701717299fe660057175b6831b4"
+    ".github/workflows/security.yml": "4701a3710d9ac91e26a07440f8f26f912e3d91499e9d1e6bf4be6fed7fe18142",
+    ".github/workflows/supply-chain.yml": "4f482ac2e07e5ef43f446b07cf5e254ab28efc646aa1d934a0c807686bd02d48"
   }
 }
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 8a5d0bf..0efb866 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -32,12 +32,12 @@ jobs:
           go-version: 1.25.x
           check-latest: true
           cache: true
-      - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: go
           config-file: ./.github/codeql/codeql-config.yml
-      - uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
-      - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
 
   govulncheck:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 443c42a..f39046e 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -154,7 +154,7 @@ jobs:
                . == "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" or
                . == "actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6" or
                . == "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" or
-               test("^github/codeql-action/(init|autobuild|analyze)@7188fc363630916deb702c7fdcf4e481b751f97a$") or
+               test("^github/codeql-action/(init|autobuild|analyze)@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81$") or
                test("^docker://[^@[:space:]]+@sha256:[0-9a-f]{64}$"));
             def safe_image:
               type == "string" and