diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index e9c6584..26e5ce0 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -29,6 +29,6 @@ jobs:
         # Fork PRs aren't granted `security-events: write`, so only upload on
         # pushes and same-repo PRs (avoids a red workflow for outside contributors).
         if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: trivy.sarif