diff --git a/.github/workflows/rg-security.yml b/.github/workflows/rg-security.yml
index a7e24ff..0d3d571 100644
--- a/.github/workflows/rg-security.yml
+++ b/.github/workflows/rg-security.yml
@@ -39,10 +39,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: ${{ inputs.codeql-languages }}
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         if: inputs.enable-dependency-review && github.event_name == 'pull_request'
         with:
@@ -55,7 +55,7 @@ jobs:
             --lockfile=${{ inputs.lockfile }}
             --format=sarif
             --output=osv-results.sarif
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         if: always() && hashFiles('osv-results.sarif') != ''
         with:
           sarif_file: osv-results.sarif
diff --git a/test/security-workflow.test.ts b/test/security-workflow.test.ts
index 8dbb707..9457440 100644
--- a/test/security-workflow.test.ts
+++ b/test/security-workflow.test.ts
@@ -13,9 +13,9 @@ function expectCodeqlPins(rgSecuritySteps: WorkflowStep[]) {
     .filter((uses): uses is string => uses?.startsWith("github/codeql-action/") ?? false)
     .map((uses) => uses.split("@")[1]);
   expect(codeqlActionVersions).toEqual([
-    "24c54180a607b1449ed407dd24f251e4e9147c8d",
-    "24c54180a607b1449ed407dd24f251e4e9147c8d",
-    "24c54180a607b1449ed407dd24f251e4e9147c8d"
+    "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee",
+    "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee",
+    "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"
   ]);
 
   const codeqlSteps = rgSecuritySteps.filter((step): step is { uses: string } =>
@@ -25,7 +25,7 @@ function expectCodeqlPins(rgSecuritySteps: WorkflowStep[]) {
   expect(codeqlVersions).toHaveLength(3);
   expect(new Set(codeqlVersions)).toEqual(
     new Set([
-      "24c54180a607b1449ed407dd24f251e4e9147c8d"
+      "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"
     ])
   );
   expect(codeqlSteps.map((step) => step.uses?.split("@")[0])).toEqual([
@@ -50,9 +50,9 @@ describe("security and reusable workflows", () => {
       } else if (mutation === "missing") {
         steps.splice(1, 1);
       } else if (mutation === "mixed") {
-        steps[1].uses = steps[1].uses!.replace(/@.*/, "@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2");
+        steps[1].uses = steps[1].uses!.replace(/@.*/, "@24c54180a607b1449ed407dd24f251e4e9147c8d");
       } else if (mutation === "tag") {
-        for (const step of steps) step.uses = step.uses!.replace(/@.*/, "@v4.38.3");
+        for (const step of steps) step.uses = step.uses!.replace(/@.*/, "@v4.39.0");
       } else {
         steps[1].uses = steps[0].uses;
       }