diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 632e8eb..495d796 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,10 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
   - package-ecosystem: gomod
     directory: /
     schedule:
diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json
index 7f03ab0..5798382 100644
--- a/.github/workflow-policy.json
+++ b/.github/workflow-policy.json
@@ -6,7 +6,7 @@
     ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f",
     ".github/workflows/license.yml": "198bc671c1cecf84eb48c7c79c278b0bac59b2a7dc878a4ceaba4dc38a15ebee",
     ".github/workflows/release-provenance.yml": "4716203f96efdd36ef740b428a628d5102461265e0a0fe4d3c5518a35498ff2e",
-    ".github/workflows/security.yml": "dc488df05a12d95414c06675855109081bb76cb409d60957c19a4cbd7b7aa513",
-    ".github/workflows/supply-chain.yml": "47a900113cd6d217b7d40148d3dbdd801d6495b14d678c235d634b270f3b9159"
+    ".github/workflows/security.yml": "85950b712f295f33d7a25c9cd029132c59ba0b5d169c2d52d7d1ebd08e30609d",
+    ".github/workflows/supply-chain.yml": "f52f7eb34b2af530bef1f3fad9041f04de8333d282136750644134be82dba766"
   }
 }
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b294e5f..a03e81d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -32,12 +32,12 @@ jobs:
           go-version: 1.26.10
           check-latest: false
           cache: true
-      - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: go
           config-file: ./.github/codeql/codeql-config.yml
-      - uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
-      - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
 
   govulncheck:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 15c286a..18456d2 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -155,7 +155,7 @@ jobs:
                . == "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" or
                . == "actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6" or
                . == "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" or
-               test("^github/codeql-action/(init|autobuild|analyze)@7188fc363630916deb702c7fdcf4e481b751f97a$") or
+               test("^github/codeql-action/(init|autobuild|analyze)@9b3254085494b55a0f7c4c2b3d2d52cc712ce370$") or
                test("^docker://[^@[:space:]]+@sha256:[0-9a-f]{64}$"));
             def safe_image:
               type == "string" and