diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b05e6a4..2a574d0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,11 +36,11 @@ jobs:
 
       - name: Initialize CodeQL
         # github/codeql-action@v4
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38
         with:
           languages: python
           queries: security-extended
 
       - name: Perform CodeQL analysis
         # github/codeql-action@v4
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f98af50..4bd23ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ This project follows [Semantic Versioning](https://semver.org/) for the installe
 
 - Add project origin and transparency documentation covering non-affiliation with the upstream MISP project, descriptive MISP-name usage, AI-assisted development under maintainer review, and validation-based trust boundaries.
 
+### Changed
+
+- Update the grouped CodeQL Actions from `v4.37.3` to `v4.37.4` at a verified immutable SHA and document the reviewed Dependabot maintenance workflow.
+
 ## [1.4.1] - 2026-07-31
 
 ### Added
diff --git a/docs/maintainer-workflow.md b/docs/maintainer-workflow.md
index 9e5bbb8..41a9ff6 100644
--- a/docs/maintainer-workflow.md
+++ b/docs/maintainer-workflow.md
@@ -148,13 +148,18 @@ The repository uses low-noise automation:
 
 ### GitHub Actions maintenance
 
-When GitHub Actions annotations report deprecations, treat them as maintenance work even if checks still pass. For pinned actions:
+Dependabot runs weekly and groups coupled GitHub Actions such as CodeQL `init`/`analyze`, workflow bootstrap actions, and artifact upload/download actions. A successful Dependabot update job means update discovery is working. A generated PR can still fail the Repository gate when its new immutable SHA has not yet been synchronized with this repository's exact-SHA assertions; that is expected maintenance work, not an automation outage or product regression.
 
-1. Identify the replacement major version from the upstream action release notes.
-2. Resolve the replacement tag to an immutable commit SHA.
-3. Update the workflow `uses:` pin and keep a nearby comment with the human-readable major version.
-4. Keep static tests SHA-enforcing so Dependabot can still update pins safely.
-5. Re-run the workflow and confirm annotations no longer include the targeted deprecation warning.
+Do not auto-merge GitHub Actions updates. For each proposed update:
+
+1. Read the upstream release notes and inspect relevant input/runtime changes.
+2. Resolve the human-readable release tag independently to its immutable commit SHA.
+3. Keep all coupled workflow invocations on the same reviewed release/SHA.
+4. Update the workflow `uses:` pins, nearby human-readable major-version comments, exact-SHA assertions, and changelog together in a focused PR.
+5. Run the complete local Repository gates and exercise the affected hosted workflow on the exact PR head.
+6. Merge only after normal maintainer review; grouping reduces split PRs but does not replace repository-specific review.
+
+When GitHub Actions annotations report deprecations, treat them as maintenance work even if checks still pass. Confirm the replacement workflow run no longer includes the targeted warning.
 
 ShellCheck is downloaded directly from the official `koalaman/shellcheck` GitHub Release by `.github/scripts/run-shellcheck.sh`. Its version, platform artifact, and SHA-256 digest are explicit constants in that script. To update it:
 
diff --git a/tests/test_static.py b/tests/test_static.py
index 2059f3d..1a9131d 100644
--- a/tests/test_static.py
+++ b/tests/test_static.py
@@ -1305,8 +1305,8 @@ def test_dependency_and_code_scanning_automation_is_configured(self):
         self.assertIn('queries: security-extended', codeql)
         self.assertIn('security-events: write', codeql)
         self.assertIn('actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1', codeql)
-        self.assertIn('github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81', codeql)
-        self.assertIn('github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81', codeql)
+        self.assertIn('github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38', codeql)
+        self.assertIn('github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38', codeql)
         self.assertIn('github/codeql-action@v4', codeql)
         self.assertNotIn('@v3', codeql)
 
@@ -1397,6 +1397,9 @@ def test_maintainer_workflow_documents_repo_operations(self):
         self.assertIn('move the conversation to [`SECURITY.md`](../SECURITY.md)', maintainer)
         self.assertIn('Remove `needs-sos-report` once', maintainer)
         self.assertIn('Dependabot for GitHub Actions updates', maintainer)
+        self.assertIn('Dependabot runs weekly and groups coupled GitHub Actions', maintainer)
+        self.assertIn('Do not auto-merge GitHub Actions updates', maintainer)
+        self.assertIn('expected maintenance work, not an automation outage or product regression', maintainer)
         self.assertIn('GitHub Actions annotations report deprecations', maintainer)
         self.assertIn('Official MISP Docker upstream drift PRs', maintainer)
         self.assertIn('| A | An official component release changed, or component defaults changed', maintainer)