diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 86a6d10..6a35eee 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,6 +41,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 0d4c243..389baf2 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -119,17 +119,17 @@ jobs:
 
       - name: Initialize CodeQL
         if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please')
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: javascript-typescript,actions
 
       - name: Autobuild
         if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please')
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL analysis
         if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please')
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
   dependency-review:
     name: Dependency review