diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e37d120311..697cb76da0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,9 +36,16 @@ jobs:
       uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
+        build-mode: manual
 
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+    - name: Set up JDK 8
+      uses: actions/setup-java@v5
+      with:
+        java-version: '8'
+        distribution: 'temurin'
+
+    - name: Build
+      run: ./gradlew build -x test --no-daemon
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/coverage-update-baseline.yml b/.github/workflows/coverage-update-baseline.yml
index 639883a8ab..34a13aa3d9 100644
--- a/.github/workflows/coverage-update-baseline.yml
+++ b/.github/workflows/coverage-update-baseline.yml
@@ -72,7 +72,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download coverage artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: base-jacoco-xml
           path: coverage-artifacts
diff --git a/.github/workflows/coverage-upload.yml b/.github/workflows/coverage-upload.yml
index e194cdd21d..e97eaa63de 100644
--- a/.github/workflows/coverage-upload.yml
+++ b/.github/workflows/coverage-upload.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Download coverage artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: jacoco-coverage
           path: coverage
@@ -43,13 +43,16 @@ jobs:
         with:
           script: |
             const headSha = context.payload.workflow_run.head_sha;
-            const { data: pulls } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+            const headOwner = context.payload.workflow_run.head_repository.owner.login;
+            const headBranch = context.payload.workflow_run.head_branch;
+            const { data: pulls } = await github.rest.pulls.list({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              commit_sha: headSha,
+              state: 'all',
+              head: `${headOwner}:${headBranch}`,
             });
-            if (pulls.length > 0) {
-              const pr = pulls[0];
+            const pr = pulls.find((p) => p.head.sha === headSha);
+            if (pr) {
               core.setOutput('pr_number', pr.number);
               core.setOutput('pr_sha', headSha);
               core.setOutput('pr_branch', headBranch);
diff --git a/.github/workflows/pr-cancel.yml b/.github/workflows/pr-cancel.yml
index 239a3b84aa..25476b31de 100644
--- a/.github/workflows/pr-cancel.yml
+++ b/.github/workflows/pr-cancel.yml
@@ -16,7 +16,7 @@ jobs:
         uses: actions/github-script@v8
         with:
           script: |
-            const workflows = ['pr-build.yml', 'system-test.yml'];
+            const workflows = ['pr-build.yml', 'system-test.yml', 'codeql.yml', 'coverage-waiting.yml'];
             const headSha = context.payload.pull_request.head.sha;
             const prNumber = context.payload.pull_request.number;
 
@@ -36,7 +36,7 @@ jobs:
                 );
 
                 for (const run of runs) {
-                  const isTargetPr = run.pull_requests?.some((pr) => pr.number === prNumber);
+                  const isTargetPr = !run.pull_requests?.length || run.pull_requests.some((pr) => pr.number === prNumber);
                   if (run.head_sha === headSha && isTargetPr) {
                     await github.rest.actions.cancelWorkflowRun({
                       owner: context.repo.owner,