diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d118fb2..2c480d2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,11 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+    groups:
+      # CodeQL refuses a workflow whose init, analyze and upload-sarif steps differ in version.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
     ignore:
       # Policy pins move by hand to a reviewed release-policy commit.
       - dependency-name: "ryanduguid/release-policy/.github/workflows/*"