diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 455c1e9..d487923 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,11 +39,11 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
 
       - name: Analyze
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: /language:${{ matrix.language }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91dd9ae..7300ca6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `@openclaw/libterminal` will be documented in this file.
 
 ### Changed
 
+- Update the paired CodeQL initialization and analysis actions to 4.39.1 and the default scanner bundle to 2.27.3. (#117, thanks @dependabot[bot])
 - Require patched Vite 8.3.5 for the test server so automatic peer resolution cannot select versions affected by the launch-editor and file-serving security advisories.
 - Refresh formatter, linter, and Playwright tooling, and align local, CI, and release setup on pnpm 11.28.4 while preserving the two-day cooldown and supported Node.js versions. (#116, thanks @dependabot[bot])