diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 4bcc2d53..f90f5783 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload Trivy scan results
         if: always()
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           sarif_file: 'trivy-${{ matrix.image }}-results.sarif'
           category: 'trivy-${{ matrix.image }}'
diff --git a/.github/workflows/sbom-compliance.yml b/.github/workflows/sbom-compliance.yml
index 5c9e36ac..943d0a59 100644
--- a/.github/workflows/sbom-compliance.yml
+++ b/.github/workflows/sbom-compliance.yml
@@ -63,7 +63,7 @@ jobs:
           retention-days: 5
 
       - name: Upload Vulnerability Report
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         if: always()
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}