diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c5b967d0..e2784a7e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -41,6 +41,11 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    groups:
+      # init, analyze and upload-sarif must run the same version (the action
+      # fails the job otherwise), so they are bumped in one PR.
+      codeql-action:
+        patterns: ["github/codeql-action/*"]
     ignore:
       # dtolnay/rust-toolchain encodes the toolchain in the pinned ref, so ANY
       # automated ref update can silently change the toolchain a workflow
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f2ab7762..b9490a00 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,13 +33,13 @@ jobs:
             build-mode: none
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           # Path and rule exclusions, each with its reason, live in the config
           # file so they are reviewable in one place.
           config-file: ./.github/codeql/codeql-config.yml
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/scorecard_analysis.yml b/.github/workflows/scorecard_analysis.yml
index f7698a4f..fbe16cfe 100644
--- a/.github/workflows/scorecard_analysis.yml
+++ b/.github/workflows/scorecard_analysis.yml
@@ -39,6 +39,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif