diff --git a/.github/workflows/hadolint-check.yml b/.github/workflows/hadolint-check.yml
index 56e6689a..76d9e31f 100644
--- a/.github/workflows/hadolint-check.yml
+++ b/.github/workflows/hadolint-check.yml
@@ -69,7 +69,7 @@ jobs:
           config: ${{ github.workspace}}/ci/.hadolint.yaml
 
       - name: Upload SARIF to Code Scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: hadolint-${{ steps.slug.outputs.name }}.sarif
           category: hadolint-${{ steps.slug.outputs.name }}
diff --git a/.github/workflows/jar-scanner.yml b/.github/workflows/jar-scanner.yml
index 89dbb58b..274c2947 100644
--- a/.github/workflows/jar-scanner.yml
+++ b/.github/workflows/jar-scanner.yml
@@ -80,7 +80,7 @@ jobs:
           summary: false
       - name: Upload SARIF result
         id: upload-sarif
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: jar-scan.output.json
           category: jar-scanning
diff --git a/.github/workflows/semgrep-scanning.yml b/.github/workflows/semgrep-scanning.yml
index 4a442137..619898d4 100644
--- a/.github/workflows/semgrep-scanning.yml
+++ b/.github/workflows/semgrep-scanning.yml
@@ -37,6 +37,6 @@ jobs:
             --output semgrep-java-scan.sarif
 
       - name: Upload SARIF to Code Scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: semgrep-java-scan.sarif