diff --git a/.github/workflows/code-analysis-built-module.yml b/.github/workflows/code-analysis-built-module.yml
index 1874887..f6f7491 100644
--- a/.github/workflows/code-analysis-built-module.yml
+++ b/.github/workflows/code-analysis-built-module.yml
@@ -59,6 +59,6 @@ jobs:
 
           Write-Information -MessageData 'Analyzing done.' -InformationAction 'Continue'
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml
index 5fec1fd..2f98354 100644
--- a/.github/workflows/code-analysis.yml
+++ b/.github/workflows/code-analysis.yml
@@ -69,6 +69,6 @@ jobs:
 
           Write-Information -MessageData 'Analyzing done.' -InformationAction 'Continue'
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 305a758..e66a30e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Bump Stale action to v10.
 - Bump Checkout action to v5.
-- Bump action codeql-action/upload-sarif to v4
+- Bump action codeql-action/upload-sarif to v4.37.4
 - Bump action checkout to v7
 - Bump action Stale to v11