diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 94d944b..931a8a1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -62,3 +62,15 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
+    groups:
+      codeql-action:
+        # `github/codeql-action/init` and `.../analyze` are two dependencies
+        # to dependabot but one unit to CodeQL: analyze rejects a config
+        # written by a different release ("Loaded a configuration file for
+        # version 4.37.4, but running version 4.36.3"). Ungrouped, dependabot
+        # opened one PR per sub-action (#25 init, #28 analyze) and *each* was
+        # red on its own while neither was wrong — bumping only one half is
+        # what breaks. Grouping puts both pins in a single PR so the pair
+        # moves together. Added 2026-08-04 after that exact split.
+        patterns:
+          - "github/codeql-action*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8359448..d68ce3a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,8 +44,14 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
 
+      # init and analyze are one unit: the config init writes is version-
+      # stamped, and analyze refuses to read a config from a different
+      # release ("Loaded a configuration file for version X, but running
+      # version Y"). Bump BOTH pins to the same SHA in the same commit —
+      # dependabot sees them as two dependencies, so .github/dependabot.yml
+      # groups them into a single PR to keep that invariant.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: csharp
 
@@ -55,5 +61,6 @@ jobs:
       - name: Build
         run: dotnet build TopSecret.ProtectedString.sln --configuration Release --no-restore
 
+      # Same SHA as the init pin above — see the note there.
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5