diff --git a/.github/workflows/image-ci.yml b/.github/workflows/image-ci.yml
index 237c2bf..56d7ab8 100644
--- a/.github/workflows/image-ci.yml
+++ b/.github/workflows/image-ci.yml
@@ -111,7 +111,7 @@ jobs:
           if-no-files-found: error
       - name: Publish SARIF to code scanning
         if: always() && github.ref == 'refs/heads/main' && github.event_name == 'push' && hashFiles('trivy-results/*.sarif') != ''
-        uses: github/codeql-action/upload-sarif@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3.39.1
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: trivy-results/janus-linux-${{ matrix.arch }}.sarif
           category: trivy-janus-linux-${{ matrix.arch }}