diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 989dade..d6eec00 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9ee088e13615f8d1eaef4766f9dde95d3356a8f6 # v2.28.0
+        uses: github/codeql-action/upload-sarif@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # v2.28.0
         with:
           sarif_file: results.sarif
diff --git a/news/20260824063632.bugfix b/news/20260824063632.bugfix
new file mode 100644
index 0000000..345fb24
--- /dev/null
+++ b/news/20260824063632.bugfix
@@ -0,0 +1 @@
+Dependency upgrade: upload-sarif-486fec2a3ea2626afcd8c7e9208b4f515078dd7e