diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 72859bcfa..fe2d53e1d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -75,11 +75,11 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     # github/codeql-action publishes immutable GitHub releases (verified via the GitHub API:
-    # "immutable": true on GET /repos/github/codeql-action/releases/tags/v4.37.3). The tag cannot
+    # "immutable": true on GET /repos/github/codeql-action/releases/tags/v4.37.8). The tag cannot
     # be retargeted, so init/analyze below are intentionally left pinned to the tag, not a SHA.
-    # See https://github.com/github/codeql-action/releases/tag/v4.37.3
+    # See https://github.com/github/codeql-action/releases/tag/v4.37.8
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.37.3
+      uses: github/codeql-action/init@v4.37.8
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -109,6 +109,6 @@ jobs:
 
     # See the immutable-release note above (github/codeql-action) — same tag, same rationale.
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.37.3
+      uses: github/codeql-action/analyze@v4.37.8
       with:
         category: "/language:${{matrix.language}}"