diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index 0d3ff49..8b82268 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -181,11 +181,25 @@ jobs:
         id: psalm
         run: |
           set +e
-          vendor/bin/psalm --output-format=json --show-info=false > psalm.json 2>&1
+          vendor/bin/psalm --output-format=json --show-info=false > psalm.json
           EXIT_CODE=$?
 
           # Generate SARIF for GitHub Security
-          vendor/bin/psalm --output-format=sarif --show-info=false > psalm.sarif 2>&1 || true
+          vendor/bin/psalm --output-format=sarif --show-info=false > psalm.sarif || true
+
+          # Sanitize SARIF: Ensure startLine/Column >= 1 (Psalm sometimes outputs 0)
+          if [ -f psalm.sarif ]; then
+            jq '
+              (.runs[].results[].locations[].physicalLocation.region) |=
+              (
+                with_entries(
+                  if .key | endswith("Line") or .key | endswith("Column") then
+                    if .value < 1 then .value = 1 else . end
+                  else . end
+                )
+              )
+            ' psalm.sarif > psalm_sanitized.sarif && mv psalm_sanitized.sarif psalm.sarif
+          fi
 
           ERRORS=$(jq 'length' psalm.json 2>/dev/null || echo "0")
           echo "errors=${ERRORS}" >> $GITHUB_OUTPUT
@@ -200,7 +214,7 @@ jobs:
 
       - name: Upload Psalm SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: psalm.sarif
           category: psalm
diff --git a/src/Mod/Trees/Console/DonateTreesToTFTF.php b/src/Mod/Trees/Console/DonateTreesToTFTF.php
index 0ce6174..76100d4 100644
--- a/src/Mod/Trees/Console/DonateTreesToTFTF.php
+++ b/src/Mod/Trees/Console/DonateTreesToTFTF.php
@@ -92,11 +92,10 @@ public function handle(): int
         $this->info("Created donation batch: {$donation->batch_reference}");
 
         // Mark all confirmed trees as planted
-        $updated = 0;
-        foreach ($confirmedTrees as $planting) {
-            $planting->markPlanted($batchReference);
-            $updated++;
-        }
+        $updated = TreePlanting::markBatchAsPlanted(
+            $confirmedTrees->modelKeys(),
+            $batchReference
+        );
 
         Log::info('Monthly tree donation batch created', [
             'batch_reference' => $batchReference,
diff --git a/src/Mod/Trees/Models/TreePlanting.php b/src/Mod/Trees/Models/TreePlanting.php
index c2f5de1..889894d 100644
--- a/src/Mod/Trees/Models/TreePlanting.php
+++ b/src/Mod/Trees/Models/TreePlanting.php
@@ -236,6 +236,23 @@ public function markConfirmed(): self
         return $this;
     }
 
+    /**
+     * Mark a batch of confirmed trees as planted.
+     *
+     * @param iterable $ids IDs of the plantings to update
+     * @param string $batchReference The TFTF batch reference
+     * @return int Number of updated records
+     */
+    public static function markBatchAsPlanted(iterable $ids, string $batchReference): int
+    {
+        return static::whereKey($ids)
+            ->update([
+                'status' => self::STATUS_PLANTED,
+                'tftf_reference' => $batchReference,
+                'updated_at' => now(),
+            ]);
+    }
+
     /**
      * Mark this planting as planted (part of TFTF donation).
      */