diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 60ad452..019769d 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -195,6 +195,16 @@ jobs:
         # gate step below decides what is actually fatal (net-new crit/high).
         run: nox scan ${{ inputs.working-directory }} -format json,sarif -output nox-results || true
       - name: Upload SARIF to code scanning
+        # Best-effort. Code scanning ingest needs GitHub Advanced Security on
+        # private repos; without it the upload returns "Resource not accessible
+        # by integration" and would fail the whole Security job. Most of the
+        # fleet is private, and the gate below -- not this upload -- is the
+        # enforcement. Same rationale as the taint-plugin install above.
+        #
+        # This only became reachable once the filename was corrected from
+        # findings.sarif to results.sarif: the step had silently skipped since
+        # it was added, so the permission problem had never surfaced.
+        continue-on-error: true
         if: always() && hashFiles('nox-results/results.sarif') != ''
         uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
         with:
diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml
index 7c11c27..0fb3c73 100644
--- a/.github/workflows/js-ci.yml
+++ b/.github/workflows/js-ci.yml
@@ -149,6 +149,16 @@ jobs:
         # Go-only taint-analysis plugin is intentionally NOT installed here.
         run: nox scan ${{ inputs.working-directory }} -format json,sarif -output nox-results || true
       - name: Upload SARIF to code scanning
+        # Best-effort. Code scanning ingest needs GitHub Advanced Security on
+        # private repos; without it the upload returns "Resource not accessible
+        # by integration" and would fail the whole Security job. Most of the
+        # fleet is private, and the gate below -- not this upload -- is the
+        # enforcement. Same rationale as the taint-plugin install above.
+        #
+        # This only became reachable once the filename was corrected from
+        # findings.sarif to results.sarif: the step had silently skipped since
+        # it was added, so the permission problem had never surfaced.
+        continue-on-error: true
         # `-output nox-results` writes results.sarif and findings.json. The SARIF
         # was looked up as findings.sarif, so hashFiles() never matched and this
         # step has silently skipped on every run since it was added — code