diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js
index 641b11a8b..c2fcd9c1b 100644
--- a/lib/analyze-action-post.js
+++ b/lib/analyze-action-post.js
@@ -117965,10 +117965,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/analyze-action.js b/lib/analyze-action.js
index 414f7b7bd..f8ba08884 100644
--- a/lib/analyze-action.js
+++ b/lib/analyze-action.js
@@ -91586,10 +91586,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js
index bf381bbd6..c2d8f0d0e 100644
--- a/lib/autobuild-action.js
+++ b/lib/autobuild-action.js
@@ -78967,10 +78967,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/init-action-post.js b/lib/init-action-post.js
index ed9a4e00b..f4117f9ad 100644
--- a/lib/init-action-post.js
+++ b/lib/init-action-post.js
@@ -129564,10 +129564,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/init-action.js b/lib/init-action.js
index d3fb02689..bedab733c 100644
--- a/lib/init-action.js
+++ b/lib/init-action.js
@@ -87823,10 +87823,10 @@ function generateCodeScanningConfig(originalUserInput, augmentationProperties) {
   return augmentedConfig;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js
index 4cda99c10..11761c618 100644
--- a/lib/resolve-environment-action.js
+++ b/lib/resolve-environment-action.js
@@ -78694,10 +78694,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/upload-lib.js b/lib/upload-lib.js
index b6376ce22..ff2f43e49 100644
--- a/lib/upload-lib.js
+++ b/lib/upload-lib.js
@@ -89411,10 +89411,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js
index 0d4da2cfc..a1ba491b1 100644
--- a/lib/upload-sarif-action.js
+++ b/lib/upload-sarif-action.js
@@ -90091,10 +90091,10 @@ async function getConfig(tempDir, logger) {
   return JSON.parse(configString);
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
   const augmentedConfig = cloneObject(cliConfig);
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
diff --git a/src/config-utils.ts b/src/config-utils.ts
index 40d1da687..64a1c93b9 100644
--- a/src/config-utils.ts
+++ b/src/config-utils.ts
@@ -1489,14 +1489,15 @@ export function generateCodeScanningConfig(
 export function appendExtraQueryExclusions(
   extraQueryExclusions: ExcludeQueryFilter[],
   cliConfig: UserConfig,
-): UserConfig {
-  if (extraQueryExclusions.length === 0) {
-    return cliConfig;
-  }
-
-  // make a copy so we can modify it
+): Readonly<UserConfig> {
+  // make a copy so we can modify it and so that modifications to the input
+  // object do not affect the result that is marked as `Readonly`.
   const augmentedConfig = cloneObject(cliConfig);
 
+  if (extraQueryExclusions.length === 0) {
+    return augmentedConfig;
+  }
+
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,