diff --git a/action.yml b/action.yml
old mode 100755
new mode 100644
index 2ef42de..5aa1ab6
--- a/action.yml
+++ b/action.yml
@@ -542,7 +542,7 @@ runs:
     # SHA pin per Marketplace SC002 hygiene; bump via Dependabot.
     - name: Upload SARIF to GitHub Advanced Security
       if: always() && inputs.enable_upload == 'true' && steps.merge.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
       with:
         sarif_file: ${{ steps.merge.outputs.sarif_path }}
         category: ${{ inputs.category }}