diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dbaa3c2e..af87e25c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         cache: 'pip'
 
     - name: Install Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v6
       with:
         node-version: '10.x'
 
@@ -79,7 +79,7 @@ jobs:
 
     - name: Upload mypy results
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: mypy-results
         path: mypy-results.txt
@@ -300,14 +300,14 @@ jobs:
 
     - name: Upload XML coverage report
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: xml-coverage-report
         path: coverage.xml
 
     - name: Upload HTML coverage report
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: html-coverage-report
         path: htmlcov/
@@ -385,7 +385,7 @@ jobs:
       run: cat cloc-report.txt
 
     - name: Upload cloc report (text)
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: cloc-text
         path: cloc-report.txt
@@ -402,7 +402,7 @@ jobs:
       run: cat cloc-summary.md
 
     - name: Upload cloc report (Markdown)
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: cloc-markdown
         path: cloc-summary.md
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..5d0ee21e
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,47 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ['*']
+  schedule:
+  - cron: '0 5 * * 1'  # Weekly on Monday at 05:00 UTC
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+        - python
+        - actions
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v4
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: '/language:${{ matrix.language }}'