diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8581bf19c2..47d3022617 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,6 +25,13 @@ updates:
       day: "sunday"
     cooldown:
       default-days: 7
+    groups:
+      # The codeql-action init/autobuild/analyze steps must all run the
+      # same version - split PRs cause a version mismatch that fails the
+      # Analyze jobs. Group them so a single PR bumps all of them together.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
 
   # Maintain dependencies for iceberg
   - package-ecosystem: "cargo"