diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index eac9fc2..3d479a5 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -20,6 +20,6 @@ jobs:
 
       - name: Scan for secrets
         # Pinned to an immutable commit SHA (supply-chain safety); bump via Dependabot.
-        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
+        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0
         with:
           extra_args: --results=verified,unknown