diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 609155f..223eb7b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,9 +5,15 @@ updates:
     schedule:
       interval: "daily"
     groups:
+      # CodeQL sub-actions must use the same version.
       codeql-actions:
+        applies-to: "version-updates"
+        patterns:
+          - "github/codeql-action/*"
+      codeql-actions-security:
+        applies-to: "security-updates"
         patterns:
-          - "github/codeql-action"
+          - "github/codeql-action/*"
 
   - package-ecosystem: "gomod"
     directories:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b559f1b..0f3d977 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -36,7 +36,7 @@ jobs:
           install_args: --locked
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: go
           build-mode: manual
@@ -45,4 +45,4 @@ jobs:
         run: mise run test:go:build
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4