diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c99b666eb..4a25e682d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,6 +16,10 @@ updates:
     labels:
       - dependencies
       - ci
+    groups:
+      codeql-action:
+        patterns:
+          - github/codeql-action/*
 
   # Keep pinned Docker base-image digests current for the root Dockerfiles.
   - package-ecosystem: docker
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 04d6d8dd2..a72adeed3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
@@ -73,6 +73,6 @@ jobs:
               - '**/test/**/fixtures/**'
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: '/language:${{ matrix.language }}'