diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0a5427c..279d6ec 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,11 +36,20 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25.11"
+          cache: true
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
           languages: go
-          build-mode: none
+          # Go does not support build-mode: none; autobuild runs `go build`,
+          # which needs no C/libbpf toolchain (the validator is a separate
+          # non-Go component).
+          build-mode: autobuild
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 8f18659..f724b19 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,6 +30,7 @@ jobs:
     permissions:
       security-events: write   # upload SARIF to code scanning
       id-token: write          # publish results to the Scorecard API
+      actions: read            # evaluate workflow token-permission/pinning checks
       contents: read
     steps:
       - name: Checkout
@@ -38,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@v2
+        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/docs/supply-chain.md b/docs/supply-chain.md
index 9dd111a..82efbef 100644
--- a/docs/supply-chain.md
+++ b/docs/supply-chain.md
@@ -60,7 +60,8 @@ These are not files in the repo. Track their status here.
 
 - `publish_results: true` in the Scorecard workflow requires the repository to
   be public; it is a no-op signal otherwise.
-- CodeQL uses `build-mode: none`, so it does not need the C/libbpf validator
-  toolchain (the validator is a separate non-Go component).
+- CodeQL uses `build-mode: autobuild` (Go does not support `none`); autobuild
+  runs `go build`, which does not need the C/libbpf validator toolchain (the
+  validator is a separate non-Go component).
 - The `Kernel-Guard` GitHub org and the "KernelGuard" site branding should be
   reconciled before a wider public launch; see the project roadmap.