diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3097139..bcd0a20 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,7 @@ updates:
     groups:
       python-dev:
         dependency-type: "development"
+
   - package-ecosystem: "npm"
     directory: "/web"
     schedule:
@@ -14,7 +15,22 @@ updates:
     groups:
       npm-dev:
         dependency-type: "development"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
\ No newline at end of file
+      interval: "weekly"
+    groups:
+      # codeql-action/init, /autobuild and /analyze MUST move together.
+      # Ungrouped, Dependabot opens one PR per sub-action, so each PR leaves
+      # the trio version-skewed and the analysis fails with:
+      #   "Loaded a configuration file for version 'X', but running version 'Y'"
+      # That is what stalled #28, #30 and #31.
+      codeql:
+        patterns:
+          - "github/codeql-action*"
+      actions:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "github/codeql-action*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index db2959f..91f300c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,10 +20,10 @@ jobs:
         language: [python, javascript-typescript]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
\ No newline at end of file