diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6755f03..86243a4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -54,6 +54,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif
diff --git a/AUDIT.md b/AUDIT.md
index 9b32b94..98cbf87 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -1,5 +1,12 @@
 # Cycles Protocol v0.1.25 — Client (Python) Audit
 
+## 2026-09-24 — Dependency maintenance
+
+Dependabot PR #100 updates the SHA-pinned CodeQL SARIF uploader from
+4.37.9 to 4.38.0. Python dependencies, SDK source, and protocol fixtures are
+unchanged. The Python 3.10/3.12 lint, typing, test/coverage, and durable
+recovery checks remain enabled and must pass before merge.
+
 **Date:** 2026-08-06 (v0.5.3 — managed streams accept caller-scoped
 idempotency keys and an opt-in post-journal settlement error surface;
 recognized commit rejections never release known spend in sync/async lifecycle