diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 7b4fab0..ab6fa4b 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with: { languages: javascript-typescript }
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
   secrets-and-dependencies:
     runs-on: ubuntu-latest
     steps:
@@ -31,7 +31,7 @@ jobs:
       - run: docker build --build-arg NEXT_PUBLIC_API_URL=http://localhost:3000 -f apps/${{ matrix.service }}/Dockerfile -t voiceforge-${{ matrix.service }}:${{ github.sha }} .
       - uses: aquasecurity/trivy-action@0.28.0
         with: { image-ref: "voiceforge-${{ matrix.service }}:${{ github.sha }}", format: sarif, output: "trivy-${{ matrix.service }}.sarif", severity: "CRITICAL,HIGH", exit-code: "1" }
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         if: always()
         with: { sarif_file: "trivy-${{ matrix.service }}.sarif" }
       - uses: anchore/sbom-action@v0