diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml
index 9946ea9059..84c562899f 100644
--- a/.github/workflows/coverity-scan.yml
+++ b/.github/workflows/coverity-scan.yml
@@ -35,7 +35,7 @@ jobs:
             libssl-dev \
             python3 \
             python3-dev \
-            python3-pip\
+            python3-pip \
             swig \
             zlib1g-dev \
             libkrb5-dev \
@@ -43,10 +43,12 @@ jobs:
             sqlite3 \
             curl \
             wget
-          # Many distros adhere to PEP 394's recommendation for `python` =
-          # `python2` so this is a simple workaround until we drop Python 2
-          # support and explicitly use `python3` for all invocations.
-          sudo ln -sf /usr/bin/python3 /usr/local/bin/python
+
+      - name: Install CAF
+        run: ( cd auxil/broker/caf && ./configure --prefix=`pwd`/build/install-root && cd build && make -j 3 install )
+
+      - name: Configure
+        run: ./configure --build-type=debug --with-caf=`pwd`/auxil/broker/caf/build/install-root
 
       - name: Fetch Coverity Tools
         env:
@@ -60,9 +62,6 @@ jobs:
           rm coverity_tool.tgz
           mv cov-analysis* coverity-tools
 
-      - name: Configure
-        run: ./configure --build-type=debug
-
       - name: Build
         run: |
           export PATH=`pwd`/coverity-tools/bin:$PATH
diff --git a/CHANGES b/CHANGES
index 34970b5d46..69bf4e9dfe 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,11 @@
 
+3.3.0-dev.648 | 2020-12-12 13:39:28 -0800
+
+  * Update Coverity Scan GitHub Action (Jon Siwek, Corelight)
+
+    * Remove old Python 2 vs. 3 workaround
+    * Build CAF separately to prevent internal errors in Coverity tools
+
 3.3.0-dev.645 | 2020-12-10 14:14:12 -0800
 
   * Fix message ordering of Broker messages (Dominik Charousset, Corelight)
diff --git a/VERSION b/VERSION
index 4c3effd7f3..d940b9cba6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.3.0-dev.645
+3.3.0-dev.648