diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c8163f3..1e1656d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -208,7 +208,7 @@ jobs:
           vuln-type: "library"
           ignore-policy: .trivyignore.rego
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         # Only upload SARIF results on main branch or version tags
         if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         with: