diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index ca22c2c..beed79f 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -64,7 +64,7 @@ jobs:
       #     --jq '.object.sha' \
       #     | xargs -I{} gh api repos/github/codeql-action/git/tags/{} --jq '.object.sha'
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3
         with:
           # bash isn't a first-class CodeQL language; `actions` is the
           # one that matters here (workflow-injection coverage).