diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 76bed29..27f1305 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -10,6 +10,9 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      # Required for upload-sarif task
+      security-events: write
     steps:
       - uses: actions/checkout@v4
       - name: set up JDK 17
@@ -22,7 +25,7 @@ jobs:
         run: chmod +x gradlew && ./gradlew build
 
       # Explained at https://medium.com/bumble-tech/android-lint-and-detekt-warnings-in-github-pull-requests-2880df5d32af
-      - uses: github/codeql-action/upload-sarif@v2
+      - uses: github/codeql-action/upload-sarif@v3
         if: success() || failure()
         with:
           sarif_file: app/build/reports/lint-results-debug.sarif