diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 38d1035..035307f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,6 +10,10 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    groups:
+      codeql-action:
+        patterns:
+          - github/codeql-action*
   - package-ecosystem: bundler
     directory: /
     open-pull-requests-limit: 100
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
index 836f75a..36ba0c1 100644
--- a/.github/workflows/analysis.yml
+++ b/.github/workflows/analysis.yml
@@ -54,9 +54,9 @@ jobs:
           fetch-depth: 0
       -
         name: initialize
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ruby
       -
         name: codeql analyze
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0