diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index d153008..868f899 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -25,7 +25,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.95.8
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
         with:
           # Empty base = full-tree scan; the action's default BASE/HEAD diff
           # mode errors with "BASE == HEAD" on direct pushes to main.