diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 98c45b1..39eabb1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
       - uses: actions/checkout@v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4.37.3
         with:
           languages: ${{ matrix.language }}
           # security-and-quality over the default: this is a protocol
@@ -50,6 +50,6 @@ jobs:
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4.37.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/container_scan.yml b/.github/workflows/container_scan.yml
index 4069d53..54ba765 100644
--- a/.github/workflows/container_scan.yml
+++ b/.github/workflows/container_scan.yml
@@ -88,7 +88,7 @@ jobs:
           exit-code: "0"
 
       - name: Upload to the Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: trivy.sarif
           # The category must describe *what was scanned*, or a run against the