diff --git a/.github/workflows/code-analysis-built-module.yml b/.github/workflows/code-analysis-built-module.yml
index 8780efe9c..8ae9880f2 100644
--- a/.github/workflows/code-analysis-built-module.yml
+++ b/.github/workflows/code-analysis-built-module.yml
@@ -67,6 +67,6 @@ jobs:
 
           Write-Information -MessageData 'Analyzing done.' -InformationAction 'Continue'
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml
index a070e8707..9a1cd2e4d 100644
--- a/.github/workflows/code-analysis.yml
+++ b/.github/workflows/code-analysis.yml
@@ -77,6 +77,6 @@ jobs:
 
           Write-Information -MessageData 'Analyzing done.' -InformationAction 'Continue'
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c8d97d34..bd4f6b141 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - SqlServerDsc
   - Bump GitHub actions checkout to v7
   - Bump action Stale to v11
+  - Bump codeql-action/upload-sarif to v4.37.4
   - Update tests to Pester 6 syntax where supported.
   - Added Windows user credential format guidance to the credential overview
     documentation. ([issue #1768](https://github.com/dsccommunity/SqlServerDsc/issues/1768))