diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8c264aa4..51ba59b7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,6 +26,10 @@ updates:
       time: "04:30"
       timezone: Europe/Berlin
     open-pull-requests-limit: 10
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
 
   - package-ecosystem: nuget
     directory: "/authority-host/windows/GitHubDeliveryAuthority"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b6cc1a9d..96bf4795 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -83,15 +83,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: javascript-typescript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
       - name: Analyze
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:javascript-typescript"
 
@@ -123,7 +123,7 @@ jobs:
           global-json-file: global.json
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: csharp
           build-mode: manual
@@ -138,6 +138,6 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Analyze
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:csharp"
diff --git a/tests/unit/actions-usage-contract.test.mjs b/tests/unit/actions-usage-contract.test.mjs
index 8a98d976..bafb2acb 100644
--- a/tests/unit/actions-usage-contract.test.mjs
+++ b/tests/unit/actions-usage-contract.test.mjs
@@ -113,6 +113,22 @@ test("superseded expensive PR workflows cancel in progress", () => {
   }
 });
 
+test("CodeQL init, autobuild, and analyze stay on the same pinned SHA", () => {
+  const pins = [...codeql.matchAll(/github\/codeql-action\/(init|autobuild|analyze)@([0-9a-f]{40})/g)];
+  const byAction = { init: [], autobuild: [], analyze: [] };
+  for (const match of pins) byAction[match[1]].push(match[2]);
+  assert.ok(byAction.init.length >= 1, "missing init pin");
+  assert.ok(byAction.autobuild.length >= 1, "missing autobuild pin");
+  assert.ok(byAction.analyze.length >= 1, "missing analyze pin");
+  const shas = new Set(pins.map((match) => match[2]));
+  assert.equal(shas.size, 1, `mixed CodeQL action SHAs: ${[...shas].join(", ")}`);
+});
+
+test("Dependabot groups github/codeql-action updates", () => {
+  const dependabot = read(".github/dependabot.yml");
+  assert.match(dependabot, /package-ecosystem: github-actions[\s\S]*groups:\s*\n\s*codeql-action:\s*\n\s*patterns:\s*\n\s*- "github\/codeql-action\*"/);
+});
+
 test("CodeQL analyses are scoped from the PR base classifier and fail closed", () => {
   assert.match(codeql, /node "\$\{TRUSTED_SCOPE\}" --mode codeql/);
   assert.match(codeql, /git show "\$\{BASE_SHA\}:scripts\/ci-scope\.mjs"/);