diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
index e0ff968bd..bad4921eb 100644
--- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
+++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml
index edc1d505d..76e3f348a 100644
--- a/.github/workflows/__build-mode-autobuild.yml
+++ b/.github/workflows/__build-mode-autobuild.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
index 7bda6ce9f..c3348db6c 100644
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -54,7 +54,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration
diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index 354da0afd..76ef6e555 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -134,7 +134,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml
index 01651796e..14a8490b8 100644
--- a/.github/workflows/rollback-release.yml
+++ b/.github/workflows/rollback-release.yml
@@ -139,7 +139,7 @@ jobs:
 
       - name: Generate token
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index a506b87ce..981a38eac 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -95,7 +95,7 @@ jobs:
       pull-requests: write # needed to create pull request
     steps:
     - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       id: app-token
       with:
         app-id: ${{ vars.AUTOMATION_APP_ID }}
diff --git a/lib/entry-points.js b/lib/entry-points.js
index befd19ec8..cb7ef17ff 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -172094,16 +172094,6 @@ var featureConfig = {
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   // Other overlay-related feature flags
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_match_codeql_version_dry_run" /* OverlayAnalysisMatchCodeqlVersionDryRun */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB",
@@ -176299,17 +176289,10 @@ async function findOverridingToolsInCache(humanReadableVersion, logger2) {
   }
   return void 0;
 }
-async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, rawLanguages, features, logger2) {
+async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, rawLanguages, logger2) {
   if (rawLanguages === void 0 || rawLanguages.length === 0) {
     return [];
   }
-  const isEnabled = await features.getValue(
-    "overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */
-  );
-  const isDryRun = !isEnabled && await features.getValue("overlay_analysis_match_codeql_version_dry_run" /* OverlayAnalysisMatchCodeqlVersionDryRun */);
-  if (!isEnabled && !isDryRun) {
-    return [];
-  }
   let cachedVersions;
   try {
     cachedVersions = await getCodeQlVersionsForOverlayBaseDatabases(
@@ -176326,46 +176309,18 @@ async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, raw
     return [];
   }
   const cachedVersionsSet = new Set(cachedVersions);
-  const overlayVersions = defaultCliVersion.enabledVersions.filter(
+  return defaultCliVersion.enabledVersions.filter(
     (v) => cachedVersionsSet.has(v.cliVersion)
   );
-  if (overlayVersions.length === 0) {
-    return [];
-  }
-  const isCachedVersionDifferent = overlayVersions[0].cliVersion !== defaultCliVersion.enabledVersions[0].cliVersion;
-  if (isCachedVersionDifferent) {
-    addNoLanguageDiagnostic(
-      void 0,
-      makeTelemetryDiagnostic(
-        "codeql-action/overlay-aware-default-codeql-version",
-        "Overlay-aware default CodeQL version selection",
-        {
-          cachedVersions,
-          enabledVersions: defaultCliVersion.enabledVersions.map(
-            (v) => v.cliVersion
-          ),
-          isDryRun,
-          overlayAwareVersion: overlayVersions[0].cliVersion
-        }
-      )
-    );
-  }
-  if (isDryRun) {
-    logger2.debug(
-      `Overlay-aware default CodeQL version selection is running in dry-run mode. Would have used version ${overlayVersions[0].cliVersion}.`
-    );
-    return [];
-  }
-  return overlayVersions;
 }
-async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger2) {
-  if (!useOverlayAwareDefaultCliVersion || !isAnalyzingPullRequest()) {
+async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, logger2) {
+  if (!useOverlayAwareDefaultCliVersion || // Listing the Actions cache can't change which version we use if only one version is enabled.
+  defaultCliVersion.enabledVersions.length === 1 || !isAnalyzingPullRequest()) {
     return defaultCliVersion.enabledVersions[0];
   }
   const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases(
     defaultCliVersion,
     rawLanguages,
-    features,
     logger2
   );
   if (overlayVersions.length > 0) {
@@ -176472,7 +176427,6 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe
         defaultCliVersion,
         rawLanguages,
         useOverlayAwareDefaultCliVersion,
-        features,
         logger2
       );
       cliVersion2 = version.cliVersion;
@@ -176492,7 +176446,6 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe
       defaultCliVersion,
       rawLanguages,
       useOverlayAwareDefaultCliVersion,
-      features,
       logger2
     );
     cliVersion2 = version.cliVersion;
diff --git a/package-lock.json b/package-lock.json
index a22b5686d..c06678b60 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -36,7 +36,7 @@
         "node-forge": "^1.4.0",
         "semver": "^7.8.5",
         "undici": "^6.28.0",
-        "uuid": "^14.0.2"
+        "uuid": "^14.0.3"
       },
       "devDependencies": {
         "@ava/typescript": "6.0.0",
@@ -57,14 +57,14 @@
         "eslint-import-resolver-typescript": "^4.4.5",
         "eslint-plugin-github": "^6.1.2",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.2.0",
+        "eslint-plugin-jsdoc": "^65.3.4",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^13.0.6",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
         "sinon": "^22.1.0",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.1"
+        "typescript-eslint": "^8.71.2"
       }
     },
     "node_modules/@aashutoshrathi/word-wrap": {
@@ -2702,17 +2702,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz",
-      "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
+      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/type-utils": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/type-utils": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -2725,7 +2725,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.1",
+        "@typescript-eslint/parser": "^8.71.2",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -2741,16 +2741,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz",
-      "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
+      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2784,14 +2784,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz",
-      "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
+      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.1",
-        "@typescript-eslint/types": "^8.71.1",
+        "@typescript-eslint/tsconfig-utils": "^8.71.2",
+        "@typescript-eslint/types": "^8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2824,14 +2824,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz",
-      "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
+      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1"
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2842,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz",
-      "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
+      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2859,15 +2859,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz",
-      "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
+      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -2902,9 +2902,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz",
-      "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
+      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2916,16 +2916,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz",
-      "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
+      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.71.1",
-        "@typescript-eslint/tsconfig-utils": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/project-service": "8.71.2",
+        "@typescript-eslint/tsconfig-utils": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -3001,16 +3001,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz",
-      "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
+      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1"
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3025,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz",
-      "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
+      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -5365,9 +5365,9 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz",
-      "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==",
+      "version": "65.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
+      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -9981,16 +9981,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz",
-      "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
+      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.1",
-        "@typescript-eslint/parser": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1"
+        "@typescript-eslint/eslint-plugin": "8.71.2",
+        "@typescript-eslint/parser": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10167,9 +10167,9 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
-      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.3.tgz",
+      "integrity": "sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
diff --git a/package.json b/package.json
index 9bfd79222..76ac14cf2 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "node-forge": "^1.4.0",
     "semver": "^7.8.5",
     "undici": "^6.28.0",
-    "uuid": "^14.0.2"
+    "uuid": "^14.0.3"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
@@ -65,14 +65,14 @@
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^65.3.4",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.71.2"
   },
   "overrides": {
     "@actions/tool-cache": {
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
index 633c2a379..eec3aa833 100644
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 57fa3cab3..1729f5409 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -267,8 +267,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Java",
         uses: pinnedUses(
           "actions/setup-java",
-          "de7274f081f381c8f8158605e0321c36c376e2e6",
-          "v6.0.1",
+          "b843ebf9b913146b38da2eaa7aeddf76074ae1ad",
+          "v6.1.0",
         ),
         with: {
           "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
diff --git a/src/feature-flags.ts b/src/feature-flags.ts
index 57d3c7c04..a4c119ad3 100644
--- a/src/feature-flags.ts
+++ b/src/feature-flags.ts
@@ -105,19 +105,6 @@ export enum Feature {
   OverlayAnalysisGo = "overlay_analysis_go",
   OverlayAnalysisJava = "overlay_analysis_java",
   OverlayAnalysisJavascript = "overlay_analysis_javascript",
-  /**
-   * When set, chooses the default CodeQL CLI version as the highest version that is both enabled by
-   * feature flags and present as an overlay-base database in the Actions cache for the configured
-   * languages. Falls back to the highest feature flagged version if no intersecting overlay-base
-   * database exists in the cache.
-   */
-  OverlayAnalysisMatchCodeqlVersion = "overlay_analysis_match_codeql_version",
-  /**
-   * Like `OverlayAnalysisMatchCodeqlVersion`, but only logs a diagnostic with the version that
-   * would have been chosen instead of actually changing the default CodeQL CLI version.
-   * `OverlayAnalysisMatchCodeqlVersion` overrides this flag.
-   */
-  OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run",
   /**
    * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
    * none are enabled, the default applies.
@@ -361,16 +348,6 @@ export const featureConfig = {
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY,
   },
   // Other overlay-related feature flags
-  [Feature.OverlayAnalysisMatchCodeqlVersion]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: undefined,
-  },
-  [Feature.OverlayAnalysisMatchCodeqlVersionDryRun]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN",
-    minimumVersion: undefined,
-  },
   [Feature.OverlayAnalysisMinDisk8Gb]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB",
diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts
index 92b536290..8da398523 100644
--- a/src/setup-codeql.test.ts
+++ b/src/setup-codeql.test.ts
@@ -1070,7 +1070,7 @@ async function fakeOverlayBaseCacheKey(
 }
 
 test.serial(
-  "getCodeQLSource uses overlay-aware default version when requested for a PR",
+  "getCodeQLSource uses overlay-aware default version for a Code Scanning PR",
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
@@ -1097,7 +1097,7 @@ test.serial(
         SAMPLE_DOTCOM_API_DETAILS,
         GitHubVariant.DOTCOM,
         false,
-        createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
+        createFeatures([]),
         new RecordingLogger(),
       );
 
@@ -1109,7 +1109,95 @@ test.serial(
 );
 
 test.serial(
-  "getCodeQLSource skips overlay-aware default version when not requested",
+  "getCodeQLSource skips the Actions cache when only one default version is enabled",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      process.env[EnvVar.CODE_SCANNING_REF] = "refs/heads/feature-branch";
+      process.env[EnvVar.CODE_SCANNING_BASE_BRANCH] = "main";
+
+      sinon.stub(api, "getAutomationID").resolves("test/");
+      const listStub = sinon.stub(api, "listActionsCaches").resolves([
+        {
+          key: await fakeOverlayBaseCacheKey(
+            "javascript",
+            SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
+            "abc-1-1",
+          ),
+        },
+      ]);
+      sinon
+        .stub(toolcache, "find")
+        .withArgs(
+          "CodeQL",
+          SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
+        )
+        .returns("/path/to/codeql");
+
+      const source = await setupCodeql.getCodeQLSource(
+        undefined,
+        SAMPLE_DEFAULT_CLI_VERSION,
+        ["javascript"],
+        undefined, // otherLanguagePacksReason
+        true,
+        SAMPLE_DOTCOM_API_DETAILS,
+        GitHubVariant.DOTCOM,
+        false,
+        createFeatures([]),
+        new RecordingLogger(),
+      );
+
+      t.assert(listStub.notCalled);
+      t.is(source.sourceType, "toolcache");
+      t.is(
+        source.toolsVersion,
+        SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
+      );
+    });
+  },
+);
+
+test.serial(
+  "getCodeQLSource skips overlay-aware default version outside pull request analysis",
+  async (t) => {
+    sinon.stub(actionsUtil, "isAnalyzingPullRequest").returns(false);
+
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+
+      sinon.stub(api, "getAutomationID").resolves("test/");
+      const listStub = sinon.stub(api, "listActionsCaches").resolves([
+        {
+          key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
+        },
+      ]);
+      sinon
+        .stub(toolcache, "find")
+        .withArgs("CodeQL", "2.20.2")
+        .returns("/path/to/codeql-2.20.2");
+
+      const source = await setupCodeql.getCodeQLSource(
+        undefined,
+        overlayMatchEnabledVersions,
+        ["javascript"],
+        undefined, // otherLanguagePacksReason
+        true,
+        SAMPLE_DOTCOM_API_DETAILS,
+        GitHubVariant.DOTCOM,
+        false,
+        createFeatures([]),
+        new RecordingLogger(),
+      );
+
+      t.assert(listStub.notCalled);
+      t.is(source.sourceType, "toolcache");
+      t.is(source.toolsVersion, "2.20.2");
+    });
+  },
+);
+
+test.serial(
+  "getCodeQLSource skips overlay-aware default version when not requested for Code Scanning",
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
@@ -1136,7 +1224,7 @@ test.serial(
         SAMPLE_DOTCOM_API_DETAILS,
         GitHubVariant.DOTCOM,
         false,
-        createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
+        createFeatures([]),
         new RecordingLogger(),
       );
 
@@ -1608,7 +1696,7 @@ test.serial(
 );
 
 test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases returns flag-enabled versions present in cache, sorted desc",
+  "getEnabledVersionsWithOverlayBaseDatabases returns enabled versions present in cache, sorted desc",
   async (t) => {
     sinon.stub(api, "getAutomationID").resolves("test/");
     sinon.stub(api, "listActionsCaches").resolves([
@@ -1632,7 +1720,6 @@ test.serial(
         await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
           overlayMatchEnabledVersions,
           ["javascript"],
-          createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
           new RecordingLogger(),
         );
       t.deepEqual(result, [
@@ -1644,7 +1731,7 @@ test.serial(
 );
 
 test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases returns empty when no cached version is flag-enabled",
+  "getEnabledVersionsWithOverlayBaseDatabases returns empty when no cached version is enabled",
   async (t) => {
     sinon.stub(api, "getAutomationID").resolves("test/");
     sinon.stub(api, "listActionsCaches").resolves([
@@ -1656,7 +1743,6 @@ test.serial(
     const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
       overlayMatchEnabledVersions,
       ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
       new RecordingLogger(),
     );
     t.deepEqual(result, []);
@@ -1673,7 +1759,6 @@ const noLanguagesMacro = makeMacro({
     const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
       overlayMatchEnabledVersions,
       rawLanguages,
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
       new RecordingLogger(),
     );
     t.deepEqual(result, []);
@@ -1698,7 +1783,6 @@ test.serial(
     const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
       overlayMatchEnabledVersions,
       ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
       new RecordingLogger(),
     );
     t.deepEqual(result, []);
@@ -1718,7 +1802,6 @@ test.serial(
     const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
       overlayMatchEnabledVersions,
       ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
       new RecordingLogger(),
     );
     t.deepEqual(result, [
@@ -1727,86 +1810,6 @@ test.serial(
   },
 );
 
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases does not list caches when both gates are off",
-  async (t) => {
-    const listStub = sinon.stub(api, "listActionsCaches").resolves([]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([]),
-      new RecordingLogger(),
-    );
-    t.deepEqual(result, []);
-    t.assert(
-      listStub.notCalled,
-      "Should not list Actions caches when both gating feature flags are off.",
-    );
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases dry-run returns empty but lists caches",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    const listStub = sinon.stub(api, "listActionsCaches").resolves([
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
-      },
-    ]);
-
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const result =
-        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-          overlayMatchEnabledVersions,
-          ["javascript"],
-          createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]),
-          new RecordingLogger(),
-        );
-      t.deepEqual(
-        result,
-        [],
-        "Dry-run should return an empty list so the caller falls back.",
-      );
-      t.assert(
-        listStub.calledOnce,
-        "Dry-run should still list Actions caches to populate the diagnostic.",
-      );
-    });
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases match flag wins over dry-run",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    sinon.stub(api, "listActionsCaches").resolves([
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
-      },
-    ]);
-
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const result =
-        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-          overlayMatchEnabledVersions,
-          ["javascript"],
-          createFeatures([
-            Feature.OverlayAnalysisMatchCodeqlVersion,
-            Feature.OverlayAnalysisMatchCodeqlVersionDryRun,
-          ]),
-          new RecordingLogger(),
-        );
-      t.deepEqual(result, [
-        { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-      ]);
-    });
-  },
-);
-
 /** The CLI version that the toolcache cleanup tests download. */
 const CLEANUP_CLI_VERSION = "2.21.0";
 /** The bundle version that the toolcache cleanup tests download. */
diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts
index b4d7416a1..c895f57f7 100644
--- a/src/setup-codeql.ts
+++ b/src/setup-codeql.ts
@@ -183,29 +183,16 @@ async function findOverridingToolsInCache(
 
 /**
  * Returns the sorted set of enabled versions that have cached overlay-base databases for the
- * given languages, or an empty list if neither the `OverlayAnalysisMatchCodeqlVersion` nor the
- * `OverlayAnalysisMatchCodeqlVersionDryRun` feature flag is enabled. When only the dry-run flag
- * is enabled, this performs the lookup and emits a telemetry diagnostic with the version that
- * would have been chosen, but still returns an empty list so the caller falls back.
+ * given languages.
  */
 export async function getEnabledVersionsWithOverlayBaseDatabases(
   defaultCliVersion: CodeQLDefaultVersionInfo,
   rawLanguages: string[] | undefined,
-  features: FeatureEnablement,
   logger: Logger,
 ): Promise<CodeQLVersionInfo[]> {
   if (rawLanguages === undefined || rawLanguages.length === 0) {
     return [];
   }
-  const isEnabled = await features.getValue(
-    Feature.OverlayAnalysisMatchCodeqlVersion,
-  );
-  const isDryRun =
-    !isEnabled &&
-    (await features.getValue(Feature.OverlayAnalysisMatchCodeqlVersionDryRun));
-  if (!isEnabled && !isDryRun) {
-    return [];
-  }
 
   let cachedVersions: string[] | undefined;
   try {
@@ -226,66 +213,35 @@ export async function getEnabledVersionsWithOverlayBaseDatabases(
   }
 
   const cachedVersionsSet = new Set(cachedVersions);
-  const overlayVersions = defaultCliVersion.enabledVersions.filter((v) =>
+  return defaultCliVersion.enabledVersions.filter((v) =>
     cachedVersionsSet.has(v.cliVersion),
   );
-
-  if (overlayVersions.length === 0) {
-    return [];
-  }
-
-  const isCachedVersionDifferent =
-    overlayVersions[0].cliVersion !==
-    defaultCliVersion.enabledVersions[0].cliVersion;
-
-  if (isCachedVersionDifferent) {
-    addNoLanguageDiagnostic(
-      undefined,
-      makeTelemetryDiagnostic(
-        "codeql-action/overlay-aware-default-codeql-version",
-        "Overlay-aware default CodeQL version selection",
-        {
-          cachedVersions,
-          enabledVersions: defaultCliVersion.enabledVersions.map(
-            (v) => v.cliVersion,
-          ),
-          isDryRun,
-          overlayAwareVersion: overlayVersions[0].cliVersion,
-        },
-      ),
-    );
-  }
-
-  if (isDryRun) {
-    logger.debug(
-      `Overlay-aware default CodeQL version selection is running in dry-run mode. Would have used version ${overlayVersions[0].cliVersion}.`,
-    );
-    return [];
-  }
-
-  return overlayVersions;
 }
 
 /**
  * Resolves the newest enabled default CLI version that has a cached overlay-base database for the
- * relevant languages, if running a Code Scanning analysis for a pull request and one exists.
- * Otherwise, falls back to the newest enabled default CLI version.
+ * relevant languages, if this is a Code Scanning analysis of a pull request, multiple default
+ * versions are enabled, and such a version exists. Otherwise, falls back to the newest enabled
+ * default CLI version.
  */
 async function resolveDefaultCliVersion(
   defaultCliVersion: CodeQLDefaultVersionInfo,
   rawLanguages: string[] | undefined,
   useOverlayAwareDefaultCliVersion: boolean,
-  features: FeatureEnablement,
   logger: Logger,
 ): Promise<CodeQLVersionInfo> {
-  if (!useOverlayAwareDefaultCliVersion || !isAnalyzingPullRequest()) {
+  if (
+    !useOverlayAwareDefaultCliVersion ||
+    // Listing the Actions cache can't change which version we use if only one version is enabled.
+    defaultCliVersion.enabledVersions.length === 1 ||
+    !isAnalyzingPullRequest()
+  ) {
     return defaultCliVersion.enabledVersions[0];
   }
 
   const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases(
     defaultCliVersion,
     rawLanguages,
-    features,
     logger,
   );
   if (overlayVersions.length > 0) {
@@ -482,7 +438,6 @@ export async function getCodeQLSource(
         defaultCliVersion,
         rawLanguages,
         useOverlayAwareDefaultCliVersion,
-        features,
         logger,
       );
       cliVersion = version.cliVersion;
@@ -505,7 +460,6 @@ export async function getCodeQLSource(
       defaultCliVersion,
       rawLanguages,
       useOverlayAwareDefaultCliVersion,
-      features,
       logger,
     );
     cliVersion = version.cliVersion;