diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 2a4b6eaa9..a66720ee9 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -79,6 +79,6 @@ jobs:
           python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py
           scorecard-sarif/results.sarif
           normalized-scorecard-results.sarif
-      - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation.
+      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 peeled commit; SHA pinning retained as supply-chain attack mitigation.
         with:
           sarif_file: normalized-scorecard-results.sarif
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index d79ec32e1..db6c3db87 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -48,7 +48,7 @@ jobs:
           skip-dirs: 'services/analysis-engine/.venv'
           trivyignores: ./.trivyignore
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation.
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 peeled commit; SHA pinning retained as supply-chain attack mitigation.
         if: always()
         with:
           sarif_file: trivy-results.sarif
diff --git a/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py b/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py
new file mode 100644
index 000000000..17419ea6b
--- /dev/null
+++ b/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py
@@ -0,0 +1,24 @@
+"""Regression contracts for CodeQL SARIF uploader provenance comments."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+EXPECTED_SHA = "db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"
+EXPECTED_VERSION = "v4.37.8"
+UPLOAD_SARIF_REF = (
+    f"github/codeql-action/upload-sarif@{EXPECTED_SHA} # {EXPECTED_VERSION} peeled commit;"
+)
+WORKFLOWS = (
+    REPO_ROOT / ".github" / "workflows" / "ossf-scorecard.yml",
+    REPO_ROOT / ".github" / "workflows" / "trivy.yml",
+)
+
+
+def test_upload_sarif_sha_and_version_comment_move_together() -> None:
+    """Keep each immutable SARIF uploader pin paired with its reviewed release label."""
+    for workflow in WORKFLOWS:
+        contents = workflow.read_text(encoding="utf-8")
+        assert contents.count(UPLOAD_SARIF_REF) == 1