diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
index 836c51f..7132c9c 100644
--- a/.github/workflows/snyk.yml
+++ b/.github/workflows/snyk.yml
@@ -46,7 +46,7 @@ jobs:
           args: --sarif-file-output=snyk-backend.sarif --file=backend/package.json
         continue-on-error: true   # don't double-fail; SARIF upload is best-effort
 
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4.37.3
         if: always()
         with:
           sarif_file: snyk-backend.sarif
@@ -80,7 +80,7 @@ jobs:
           args: --sarif-file-output=snyk-root.sarif --file=package.json
         continue-on-error: true
 
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4.37.3
         if: always()
         with:
           sarif_file: snyk-root.sarif