diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ef76fd3..ed7db40 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,8 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    groups:
+      # Group codeql actions
+      codeql:
+        patterns:
+          - "github/codeql-action*"
diff --git a/.github/workflows/auto_dependabot.yml b/.github/workflows/auto_dependabot.yml
index e87634b..8950bd9 100644
--- a/.github/workflows/auto_dependabot.yml
+++ b/.github/workflows/auto_dependabot.yml
@@ -6,6 +6,7 @@ on:
 permissions:
   pull-requests: write
   contents: write
+  actions: write
 
 jobs:
   auto_approve_merge: