diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index cbf3141..e5921c7 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -29,7 +29,7 @@ jobs:
       - name: TruffleHog OSS
         # Pinned to a release commit. The scanner image itself still defaults
         # to "latest" so new detectors arrive without a workflow change.
-        uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
+        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
         with:
           # On push: scan only the new commits in this push
           # On PR: scan only the commits added by the PR branch