diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0b768bbb9..b8ba876c1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -59,6 +59,9 @@ jobs:
         uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8
         with:
           languages: ${{ matrix.language }}
+          # The alert suppression query marks the alerts that a `// codeql[<query-id>]`
+          # comment covers with a SARIF suppressions field. The default queries still run.
+          packs: codeql/go-queries:AlertSuppression.ql
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8
diff --git a/app/controlplane/internal/service/casredirect.go b/app/controlplane/internal/service/casredirect.go
index c49e08ecb..e003052cb 100644
--- a/app/controlplane/internal/service/casredirect.go
+++ b/app/controlplane/internal/service/casredirect.go
@@ -308,5 +308,6 @@ func (s *CASRedirectService) setDownloadVerifierCookie(w http.ResponseWriter, fl
 		cookie.MaxAge = -1
 		cookie.Expires = time.Unix(1, 0)
 	}
+	// codeql[go/cookie-secure-not-set] Secure is true, and false only in development mode.
 	http.SetCookie(w, cookie)
 }
diff --git a/internal/redaction/redaction.go b/internal/redaction/redaction.go
index cd0687f9f..c800f9e8a 100644
--- a/internal/redaction/redaction.go
+++ b/internal/redaction/redaction.go
@@ -597,6 +597,7 @@ func (w *rewriter) redactLeaf(s, path string) string {
 	w.count += n
 
 	var out string
+	// codeql[go/unsafe-quoting] body is escaped by encodeStringBody, and the sink is a JSON decode.
 	if err := json.Unmarshal([]byte(`"`+body+`"`), &out); err != nil {
 		// A replacement cut through a JSON escape sequence. Drop the whole leaf
 		// rather than risk leaving part of the secret behind.