diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9591d50..b80613e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,17 +31,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4.38.0
+      - uses: github/codeql-action/init@v4.38.1
         with:
           languages: python
-      - uses: github/codeql-action/analyze@v4.38.0
+      - uses: github/codeql-action/analyze@v4.38.1
 
   analyze-java:
     name: codeql (java)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4.38.0
+      - uses: github/codeql-action/init@v4.38.1
         with:
           languages: java-kotlin
           # App Components/Source is raw Mendix module source (no pom.xml/build.gradle,
@@ -51,4 +51,4 @@ jobs:
           # it still catches source-level security queries (e.g. XPath injection) at
           # the cost of missing anything that needs resolved byte-code/type info.
           build-mode: none
-      - uses: github/codeql-action/analyze@v4.38.0
+      - uses: github/codeql-action/analyze@v4.38.1
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 24c4cb8..9e65e0a 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -112,7 +112,7 @@ jobs:
           output: trivy-${{ matrix.image }}.sarif
           exit-code: '0'
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4.38.0
+        uses: github/codeql-action/upload-sarif@v4.38.1
         with:
           sarif_file: trivy-${{ matrix.image }}.sarif
           category: trivy-${{ matrix.image }}
@@ -143,7 +143,7 @@ jobs:
       - name: Bandit scan (full report, SARIF)
         run: bandit -r "${{ matrix.service }}/app" -f sarif -o bandit.sarif --exit-zero
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4.38.0
+        uses: github/codeql-action/upload-sarif@v4.38.1
         with:
           sarif_file: bandit.sarif
           category: bandit-${{ matrix.service }}
@@ -170,7 +170,7 @@ jobs:
           exit-code: '1'
       - name: Upload SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v4.38.0
+        uses: github/codeql-action/upload-sarif@v4.38.1
         with:
           sarif_file: trivy-secrets.sarif
           category: trivy-secrets