diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f173259..c8163f3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -208,7 +208,7 @@ jobs:
           vuln-type: "library"
           ignore-policy: .trivyignore.rego
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         # Only upload SARIF results on main branch or version tags
         if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         with: