diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
index bb9f9bf51..6997a7f68 100644
--- a/.github/workflows/snyk.yml
+++ b/.github/workflows/snyk.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: "Upload Snyk Code SARIF to GitHub"
         # Aligned with v3 for consistency, pinned to SHA for security
-        uses: "github/codeql-action/upload-sarif@7d9249f5a57288b8a472ddd9cc3ece1921f7dc38"
+        uses: "github/codeql-action/upload-sarif@d97b3428e8eebbb1810cf454d6397886d136b4ba"
         if: "always() && hashFiles('snyk-code.sarif') != ''"
         with:
           sarif_file: "snyk-code.sarif"
@@ -57,7 +57,7 @@ jobs:
       - name: "Upload Snyk Open Source SARIF to GitHub"
         # Pinned to CodeQL upload-sarif v3 for security stability; refresh periodically
         # Aligned with v3 for consistency, pinned to SHA for security
-        uses: "github/codeql-action/upload-sarif@7d9249f5a57288b8a472ddd9cc3ece1921f7dc38"
+        uses: "github/codeql-action/upload-sarif@d97b3428e8eebbb1810cf454d6397886d136b4ba"
         if: "always() && hashFiles('snyk-os.sarif') != ''"
         with:
           sarif_file: "snyk-os.sarif"
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index f063b1582..971459ab2 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -37,7 +37,7 @@ jobs:
 
       - name: "Upload Trivy scan results to GitHub Security tab"
         # Pinned to CodeQL upload-sarif v3 for security stability; refresh periodically
-        uses: "github/codeql-action/upload-sarif@7d9249f5a57288b8a472ddd9cc3ece1921f7dc38"
+        uses: "github/codeql-action/upload-sarif@d97b3428e8eebbb1810cf454d6397886d136b4ba"
         if: "always()"  # Upload even if scan fails
         with:
           sarif_file: "trivy-results.sarif"