diff --git a/.github/workflows/ci-large.yml b/.github/workflows/ci-large.yml
index 7a85d52f0..a51c78a45 100644
--- a/.github/workflows/ci-large.yml
+++ b/.github/workflows/ci-large.yml
@@ -36,7 +36,7 @@ jobs:
           - label: dynamic_module
             os: ubuntu-latest
             cc: gcc-12
-            openresty: 1.21.4.2
+            openresty: 1.25.3.1
             runtime: wasmtime
             wasmtime: 14.0.3
             debug: debug
@@ -78,7 +78,7 @@ jobs:
           - label: openresty
             os: ubuntu-22.04
             cc: gcc-12
-            openresty: 1.21.4.2
+            openresty: 1.25.3.1
             runtime: wasmer
             wasmer: 3.1.1
             debug: debug
@@ -104,7 +104,7 @@ jobs:
       matrix:
         os: [ubuntu-latest]
         cc: [clang-15]
-        openresty: [1.21.4.2]
+        openresty: [1.25.3.1]
         runtime: [wasmtime, wasmer, v8]
         wasmtime: [14.0.3]
         wasmer: [3.1.1]
@@ -129,6 +129,7 @@ jobs:
       fail-fast: false
       matrix:
         language: ["c-cpp"]
+        openresty: [1.25.3.1]
         runtime: [wasmtime, wasmer, v8]
     uses: ./.github/workflows/job-codeql-analyzer.yml
     with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f71d59678..a0083c264 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,7 +94,7 @@ jobs:
           - label: openresty
             os: ubuntu-latest
             cc: gcc-12
-            openresty: 1.21.4.2
+            openresty: 1.25.3.1
             runtime: wasmtime
             wasmtime: 14.0.3
             ssl: ssl
@@ -104,7 +104,7 @@ jobs:
           - label: dynamic_openresty
             os: ubuntu-latest
             cc: gcc-12
-            openresty: 1.21.4.2
+            openresty: 1.25.3.1
             runtime: wasmtime
             wasmtime: 14.0.3
             ssl: ssl
@@ -139,7 +139,7 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           parallel-finished: true
-          carryforward: 'unit-ngx_1.25.3-wasmer-ssl-debug-no_hup-static,unit-ngx_1.25.3-wasmer-ssl-no_debug-no_hup-static,unit-ngx_1.25.3-wasmtime-ssl-debug-hup-static,unit-ngx_1.25.3-wasmtime-ssl-debug-hup-dynamic,unit-ngx_1.25.3-v8-ssl-debug-no_hup-static,unit-ngx_1.21.6-wasmer-ssl-debug-no_hup-static,unit-ngx_1.25.3-wasmer-no_ssl-no_debug-no_hup-static,unit-openresty_1.21.4.2-wasmtime-ssl-debug-no_hup-static,unit-openresty_1.21.4.2-wasmtime-ssl-debug-no_hup-dynamic'
+          carryforward: 'unit-ngx_1.25.3-wasmer-ssl-debug-no_hup-static,unit-ngx_1.25.3-wasmer-ssl-no_debug-no_hup-static,unit-ngx_1.25.3-wasmtime-ssl-debug-hup-static,unit-ngx_1.25.3-wasmtime-ssl-debug-hup-dynamic,unit-ngx_1.25.3-v8-ssl-debug-no_hup-static,unit-ngx_1.21.6-wasmer-ssl-debug-no_hup-static,unit-ngx_1.25.3-wasmer-no_ssl-no_debug-no_hup-static,unit-openresty_1.25.3.1-wasmtime-ssl-debug-no_hup-static,unit-openresty_1.25.3.1-wasmtime-ssl-debug-no_hup-dynamic'
 
   valgrind:
     name: 'Valgrind'
@@ -184,7 +184,7 @@ jobs:
             wasmer: 3.1.1
             os: ubuntu-22.04
             cc: gcc-12
-            openresty: 1.21.4.2
+            openresty: 1.25.3.1
             ngx:
             debug: debug
             hup: no_hup
@@ -249,7 +249,7 @@ jobs:
       fail-fast: false
       matrix:
         cc: [clang-15]
-        openresty: [1.21.4.2]
+        openresty: [1.25.3.1]
         runtime: [wasmtime, wasmer, v8]
         wasmtime: [14.0.3]
         wasmer: [3.1.1]
@@ -283,10 +283,12 @@ jobs:
       fail-fast: false
       matrix:
         language: ["c-cpp"]
+        openresty: [1.25.3.1]
         runtime: [wasmtime, wasmer, v8]
     uses: ./.github/workflows/job-codeql-analyzer.yml
     with:
       language: ${{ matrix.language }}
+      openresty: ${{ matrix.openresty }}
       runtime: ${{ matrix.runtime }}
 
   build:
diff --git a/.github/workflows/job-codeql-analyzer.yml b/.github/workflows/job-codeql-analyzer.yml
index 85400ec0d..878d30e69 100644
--- a/.github/workflows/job-codeql-analyzer.yml
+++ b/.github/workflows/job-codeql-analyzer.yml
@@ -6,6 +6,9 @@ on:
       language:
         required: true
         type: string
+      openresty:
+        required: true
+        type: string
       runtime:
         required: true
         type: string
@@ -15,7 +18,7 @@ defaults:
     shell: bash
 
 env:
-  NGX_BUILD_OPENRESTY: 1.21.4.2
+  NGX_BUILD_OPENRESTY: ${{ inputs.openresty }}
   NGX_BUILD_DEBUG: 1
   NGX_BUILD_SSL: 1
   NGX_BUILD_DYNAMIC_MODULE: 1