diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 266f74cb..a30cf693 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -34,7 +34,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: results.sarif
           category: zizmor
\ No newline at end of file
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 667e912a..e232e54b 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -5,4 +5,5 @@ rules:
       policies:
         # Allow pin by ref/tag
         actions-rust-lang/setup-rust-toolchain: ref-pin
+        github/codeql-action/*: ref-pin
         actions/*: ref-pin