diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 125ab2fd..1da2643a 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0 # full history for diff + scheduled full scans
 
       - name: Scan for secrets
-        uses: trufflesecurity/trufflehog@v3.95.3
+        uses: trufflesecurity/trufflehog@v3.95.5
         with:
           # Report verified secrets and ones TruffleHog cannot verify. Tighten
           # to `--results=verified` if a fork finds the unknown class too noisy.