diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3dd5be97..c63a23f9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -87,7 +87,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialise CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           # Nothing is compiled. build.yml already builds this product on a Windows runner on the
@@ -97,6 +97,6 @@ jobs:
           queries: security-extended
 
       - name: Analyse
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 5a50fbe4..2c939670 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -199,7 +199,7 @@ jobs:
 
       # Its own category, so these alerts never replace CodeQL's and CodeQL's never replace these.
       # An upload with no results is what closes an alert that a merged fix made obsolete.
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: ${{ runner.temp }}/osv/osv.sarif
           category: osv-scanner