diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2cbcd3371..bf2956991 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,34 +18,43 @@
 #
 #
 ---
+# Static analysis of the Python sources and the GitHub Actions workflows.
+# Results are uploaded to the "Security" tab of the repository.
 name: "CodeQL"
 
 on:  # yamllint disable-line rule:truthy
   pull_request:
-    branches: ['main']
+    branches:
+      - "main"
   push:
-    branches: [main]
+    branches:
+      - "main"
   schedule:
-    - cron: '0 2 * * *'
+    # Off the top of the hour to avoid the load peak on GitHub's runners.
+    - cron: '23 2 * * *'
+
+# Permissions are set on each job individually.
+permissions: {}
 
-permissions:
-  contents: read
 concurrency:
   group: codeql-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  # Only PR runs are superseded by a newer push.
+  # Push and scheduled runs must complete to keep the Security tab current.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   analyze:
     name: Analyze
-    runs-on: ["ubuntu-22.04"]
+    runs-on: ubuntu-slim
     strategy:
       fail-fast: false
       matrix:
-        language: ['python', 'actions']
+        language:
+          - "python"
+          - "actions"
     permissions:
-      actions: read
-      contents: read
-      pull-requests: read
+      # Required to upload the SARIF results.
+      # Read permissions are implicit on a public repository.
       security-events: write
     steps:
       - name: Checkout repository
@@ -58,8 +67,5 @@ jobs:
         with:
           languages: ${{ matrix.language }}
 
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 2019633dc..000000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '16 4 * * 1'
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze Actions
-    runs-on: ubuntu-slim
-    permissions:
-      contents: read
-      security-events: write
-      packages: read
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        persist-credentials: false
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
-      with:
-        languages: actions
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
-      with:
-        category: "/language:actions"