diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cf9bb503fb..f517ab2c65 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -120,7 +120,7 @@ jobs:
       # only upload results if the analysis fails
       # otherwise, save the output and use `advanced-security/filter-sarif` to filter paths
       - name: CodeQL Analyze
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:${{matrix.language}}"
           output: sarif-results