diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index b5744ac..b68032f 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -29,7 +29,7 @@ jobs:
       - name: TruffleHog OSS
         # Pinned to a release commit. The scanner image itself still defaults
         # to "latest" so new detectors arrive without a workflow change.
-        uses: trufflesecurity/trufflehog@e63326d6545de8f425d93ce24078c6e68d83f70e # v3.99.3
+        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 # v3.99.7
         with:
           # On push: scan only the new commits in this push
           # On PR: scan only the commits added by the PR branch