diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c19199c..a658fa4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,3 +15,11 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - "dependencies"
+    # github/codeql-action/init and .../analyze must run at the SAME version;
+    # a run with mismatched versions aborts with "Loaded a configuration file
+    # for version X, but running version Y". Ungrouped, Dependabot opens one
+    # PR per sub-action, so each one is red on its own and neither can merge.
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bf0941d..cd5b0e1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,10 +28,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"