diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca3f4fd..56baa5e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,3 +25,10 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    groups:
+      # codeql-action/init and codeql-action/analyze are separate update paths,
+      # so ungrouped Dependabot files one PR each — and CodeQL fails the SARIF
+      # upload whenever the two land on different versions. Group them so they
+      # always move together in a single PR.
+      codeql-action:
+        patterns: ["github/codeql-action*"]
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c801cae..b7a3ce3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: github.actor != 'dependabot[bot]'
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: python
           # Security queries only. The "security-and-quality" suite also runs
@@ -46,4 +46,4 @@ jobs:
 
       - name: Perform CodeQL analysis
         if: github.actor != 'dependabot[bot]'
-        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/analyze@c54b30b7df092240050e69945842bc67aee0f0f4 # v4.37.3
diff --git a/requirements.lock b/requirements.lock
index cdcbfe2..10f496e 100644
--- a/requirements.lock
+++ b/requirements.lock
@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml --extra server --python-version 3.12 --universal --generate-hashes --refresh -o requirements.lock
+#    uv pip compile pyproject.toml --extra server --python-version 3.12 --universal --generate-hashes -o requirements.lock
 annotated-doc==0.0.4 \
     --hash=sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320 \
     --hash=sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4