diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml
index 85a9fae07..2c52eacac 100644
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.16.6
-          - os: macos-latest
-            version: stable-v2.16.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: macos-latest
             version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml
index 02f1e1dac..4192af314 100644
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.16.6
-          - os: macos-latest
-            version: stable-v2.16.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: macos-latest
             version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml
index b6049c158..bc748bf38 100644
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.16.6
-          - os: macos-latest
-            version: stable-v2.16.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: macos-latest
             version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml
index 2d8c93417..6847bc26e 100644
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
-            version: stable-v2.16.6
-          - os: ubuntu-latest
-            version: stable-v2.16.6
           - os: macos-latest
             version: stable-v2.17.6
           - os: ubuntu-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.20.7
+          - os: macos-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.21.4
           - os: macos-latest
             version: default
           - os: ubuntu-latest
diff --git a/README.md b/README.md
index 90a388f67..c5b8eab81 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v3.28.21`  | `2.20.7` | Enterprise Server 3.18 | |
+| `v3.28.21`  | `2.21.3` | Enterprise Server 3.18 | |
 | `v3.28.12`  | `2.20.7` | Enterprise Server 3.17 | |
 | `v3.28.6`  | `2.20.3` | Enterprise Server 3.16 | |
 | `v3.28.6`  | `2.20.3` | Enterprise Server 3.15 | |
diff --git a/pr-checks/sync.py b/pr-checks/sync.py
index c8a2ff196..61ec0bb1c 100755
--- a/pr-checks/sync.py
+++ b/pr-checks/sync.py
@@ -9,8 +9,6 @@ import os
 # The default set of CodeQL Bundle versions to use for the PR checks.
 defaultTestVersions = [
     # The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
-    "stable-v2.16.6",
-    # The last CodeQL release in the 2.17 series.
     "stable-v2.17.6",
     # The last CodeQL release in the 2.18 series.
     "stable-v2.18.4",
@@ -18,6 +16,8 @@ defaultTestVersions = [
     "stable-v2.19.4",
     # The last CodeQL release in the 2.20 series.
     "stable-v2.20.7",
+    # The last CodeQL release in the 2.21 series.
+    "stable-v2.21.4",
     # The default version of CodeQL for Dotcom, as determined by feature flags.
     "default",
     # The version of CodeQL shipped with the Action in `defaults.json`. During the release process