diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index fba484f..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-# CodeQL Security Analysis
-# Performs static application security testing (SAST) using GitHub CodeQL.
-#
-# IMPORTANT: GitHub's CodeQL "default setup" must remain DISABLED for this repo.
-# Default setup and custom advanced configuration cannot both upload SARIF to the
-# Security tab. To verify or disable: Settings > Code security > Code scanning > Default setup.
-name: CodeQL Analysis
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-  schedule:
-    - cron: "0 7 * * 1"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: codeql-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  analyze:
-    name: CodeQL Analyze (Python)
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-
-      - name: Install dependencies
-        run: uv sync --no-dev
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
-        with:
-          languages: python
-          build-mode: none
-          queries: security-extended,security-and-quality
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
-        with:
-          category: "/language:python"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
deleted file mode 100644
index fd42889..0000000
--- a/.github/workflows/dependency-review.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-# Dependency Review - Analyzes dependency changes in PRs
-# Checks for vulnerabilities and license compliance
-#
-# Features:
-#   - Vulnerability detection in dependency changes
-#   - License compliance checking
-#   - Blocks PRs with high severity vulnerabilities
-name: Dependency Review
-
-on:
-  pull_request:
-    branches: [main, master, develop]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    name: Dependency Review
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Dependency Review
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          fail-on-severity: high
-          allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, LGPL-2.1, LGPL-3.0, Python-2.0, Unlicense, CC0-1.0, GPL-3.0-or-later
-          comment-summary-in-pr: on-failure
diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
index 438e58e..234588c 100644
--- a/.github/workflows/security-analysis.yml
+++ b/.github/workflows/security-analysis.yml
@@ -5,8 +5,10 @@
 # Note: this workflow is intentionally standalone and does NOT call the org
 # reusable python-security-analysis.yml, which has been failing at startup
 # (startup_failure) for months and silently withheld the required
-# "Security Gate Validation" status check. CodeQL and dependency review are
-# covered by codeql.yml and dependency-review.yml respectively.
+# "Security Gate Validation" status check. CodeQL (codeql.yml) and dependency
+# review (dependency-review.yml) were removed: GitHub now bills Advanced
+# Security (Code Security), so both stopped functioning fleet-wide. Bandit
+# and OSV-Scanner below continue to run and are unaffected.
 name: Security Analysis
 
 "on":
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 066b487..c3a5e6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -76,6 +76,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `pr-validation.yml`: added the `Dependency & Standards Validation` summary job.
 - Resolved CodeQL false positive for incomplete URL substring sanitization in test file
 
+### Removed
+
+- `.github/workflows/codeql.yml` and `.github/workflows/dependency-review.yml`.
+  GitHub now bills Advanced Security (Code Security), so CodeQL code scanning
+  and the `dependency-review` action no longer function. Bandit and
+  OSV-Scanner (`security-analysis.yml`) continue to run and are unaffected.
+
 ### Added
 
 - Initial project setup and structure