diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 450940ad..b02b448f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -31,3 +31,9 @@ updates:
       time: '06:15'
       timezone: America/New_York
     open-pull-requests-limit: 5
+    groups:
+      # init and analyze must move together. Split updates leave CodeQL with
+      # incompatible action revisions and fail before analysis can start.
+      codeql-action:
+        patterns:
+          - 'github/codeql-action/*'