diff --git a/.github/workflows/security-daily.yml b/.github/workflows/security-daily.yml
index ee6f0f3..26ef4f2 100644
--- a/.github/workflows/security-daily.yml
+++ b/.github/workflows/security-daily.yml
@@ -38,13 +38,27 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+
+      - name: Install Semgrep
+        run: python -m pip install semgrep==1.171.0
+
       - name: Run Semgrep
-        uses: returntocorp/semgrep-action@v1
+        run: |
+          semgrep scan \
+            --config p/golang \
+            --config p/security-audit \
+            --error \
+            --sarif --output semgrep.sarif
+
+      - name: Upload SARIF
+        if: always() && hashFiles('semgrep.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          config: >-
-            p/golang
-            p/security-audit
-          generateSarif: "1"
+          sarif_file: semgrep.sarif
 
   gosec:
     name: "gosec: Full Scan"