diff --git a/.github/workflows/scorecard-analysis.yml b/.github/workflows/scorecard-analysis.yml
index 2d147bee..8db04af9 100644
--- a/.github/workflows/scorecard-analysis.yml
+++ b/.github/workflows/scorecard-analysis.yml
@@ -29,6 +29,6 @@ jobs:
           results_format: sarif
           publish_results: false
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif
diff --git a/tests/workflow_queue_contract.rs b/tests/workflow_queue_contract.rs
index 0e1c4659..16318e63 100644
--- a/tests/workflow_queue_contract.rs
+++ b/tests/workflow_queue_contract.rs
@@ -63,5 +63,6 @@ fn local_scorecard_preserves_non_pr_security_evidence() {
     assert!(workflow.contains("schedule:"));
     assert!(workflow.contains("push:"));
     assert!(!workflow.contains("pull_request:"));
+    assert!(workflow.contains("security-events: write"));
     assert!(workflow.contains("# v2.4.4"));
 }