diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9a350e5..0a63a95 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,3 +5,7 @@ updates:
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    groups:
+      codeql:
+        patterns:
+          - github/codeql-action/*
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0162b66..e42570c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -56,7 +56,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -67,6 +67,6 @@ jobs:
         run: swift build --arch arm64
 
       - name: Analyze
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5240447..31550b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -97,7 +97,7 @@ jobs:
 
       - name: Upload dry-run artifacts
         if: inputs.dry_run
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Codex-Limits-${{ inputs.version }}
           path: |
diff --git a/Tests/CodexLimitsTests/GrokBillingClientTests.swift b/Tests/CodexLimitsTests/GrokBillingClientTests.swift
index ac5b64b..03fdf2a 100644
--- a/Tests/CodexLimitsTests/GrokBillingClientTests.swift
+++ b/Tests/CodexLimitsTests/GrokBillingClientTests.swift
@@ -180,8 +180,8 @@ final class GrokBillingClientTests: XCTestCase {
             let executable = try script(in: directory, body: """
             /bin/sleep 60 &
             child=$!
-            printf '%s %s\\n' "$$" "$child" > '\(record.path)'
             trap 'kill "$child" 2>/dev/null; wait "$child" 2>/dev/null; exit 0' TERM
+            printf '%s %s\\n' "$$" "$child" > '\(record.path)'
             wait "$child"
             """)
             let started = Date()
@@ -206,8 +206,15 @@ final class GrokBillingClientTests: XCTestCase {
             let pids = try String(contentsOf: record).split(whereSeparator: \.isWhitespace).compactMap { Int32($0) }
             XCTAssertEqual(pids.count, 2)
             for pid in pids {
-                XCTAssertEqual(kill(pid, 0), -1)
-                XCTAssertEqual(errno, ESRCH)
+                // The kernel can reap a killed descendant after its parent exits.
+                let deadline = ProcessInfo.processInfo.systemUptime + 1
+                while kill(pid, 0) == 0, ProcessInfo.processInfo.systemUptime < deadline {
+                    try await Task.sleep(for: .milliseconds(10))
+                }
+                let result = kill(pid, 0)
+                let processError = errno
+                XCTAssertEqual(result, -1)
+                XCTAssertEqual(processError, ESRCH)
             }
         }
     }