diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index baad1b2..a49c327 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,7 +37,7 @@ jobs:
           restore-keys: |
             maven-codeql-
 
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.3
         with:
           languages: java-kotlin
           # security-and-quality includes the security-extended pack plus
@@ -50,6 +50,6 @@ jobs:
       - name: Compile
         run: mvn -B -ntp -DskipTests -Dspotless.check.skip=true -Dlicense.skip=true package
 
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.3
         with:
           category: /language:java-kotlin
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index a622f05..d803f98 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -92,7 +92,7 @@ jobs:
 
       - name: Upload SARIF to GitHub Security tab
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: target/dependency-check-report.sarif
           category: dependency-check