diff --git a/CHANGELOG.md b/CHANGELOG.md
index b023f376bc..923cc8264a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 ## [UNRELEASED]
 
 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
+- Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)
 
 ## 4.31.2 - 30 Oct 2025
 
diff --git a/lib/analyze-action.js b/lib/analyze-action.js
index fd43a2f778..deb4af9064 100644
--- a/lib/analyze-action.js
+++ b/lib/analyze-action.js
@@ -88210,8 +88210,8 @@ var path4 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs3 = __toESM(require("fs"));
diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js
index d09fe07d82..fdeb4d70d9 100644
--- a/lib/autobuild-action.js
+++ b/lib/autobuild-action.js
@@ -83700,8 +83700,8 @@ var path3 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));
diff --git a/lib/defaults.json b/lib/defaults.json
index 1fa392f548..9be5b5476c 100644
--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.3",
-  "cliVersion": "2.23.3",
-  "priorBundleVersion": "codeql-bundle-v2.23.2",
-  "priorCliVersion": "2.23.2"
+  "bundleVersion": "codeql-bundle-v2.23.5",
+  "cliVersion": "2.23.5",
+  "priorBundleVersion": "codeql-bundle-v2.23.3",
+  "priorCliVersion": "2.23.3"
 }
diff --git a/lib/init-action-post.js b/lib/init-action-post.js
index 1d3c4d5d93..ef36db5296 100644
--- a/lib/init-action-post.js
+++ b/lib/init-action-post.js
@@ -122974,8 +122974,8 @@ var path4 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs3 = __toESM(require("fs"));
diff --git a/lib/init-action.js b/lib/init-action.js
index 98c23c88fd..41cdafba15 100644
--- a/lib/init-action.js
+++ b/lib/init-action.js
@@ -85634,8 +85634,8 @@ var path5 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs3 = __toESM(require("fs"));
diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js
index c9e95730bf..e119b94772 100644
--- a/lib/setup-codeql-action.js
+++ b/lib/setup-codeql-action.js
@@ -83588,8 +83588,8 @@ var path4 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs3 = __toESM(require("fs"));
diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js
index 281341e5aa..2af00a59a4 100644
--- a/lib/start-proxy-action.js
+++ b/lib/start-proxy-action.js
@@ -99683,8 +99683,8 @@ function getActionsLogger() {
 var core7 = __toESM(require_core());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/languages.ts
 var KnownLanguage = /* @__PURE__ */ ((KnownLanguage2) => {
diff --git a/lib/upload-lib.js b/lib/upload-lib.js
index 2e980ba467..dc7d0d162b 100644
--- a/lib/upload-lib.js
+++ b/lib/upload-lib.js
@@ -86724,8 +86724,8 @@ var path4 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs3 = __toESM(require("fs"));
diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js
index 6fd196c32e..46c84e88cc 100644
--- a/lib/upload-sarif-action.js
+++ b/lib/upload-sarif-action.js
@@ -86504,8 +86504,8 @@ var path4 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.3";
-var cliVersion = "2.23.3";
+var bundleVersion = "codeql-bundle-v2.23.5";
+var cliVersion = "2.23.5";
 
 // src/overlay-database-utils.ts
 var fs3 = __toESM(require("fs"));
diff --git a/src/defaults.json b/src/defaults.json
index 1fa392f548..9be5b5476c 100644
--- a/src/defaults.json
+++ b/src/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.3",
-  "cliVersion": "2.23.3",
-  "priorBundleVersion": "codeql-bundle-v2.23.2",
-  "priorCliVersion": "2.23.2"
+  "bundleVersion": "codeql-bundle-v2.23.5",
+  "cliVersion": "2.23.5",
+  "priorBundleVersion": "codeql-bundle-v2.23.3",
+  "priorCliVersion": "2.23.3"
 }