diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml
index 939477e298..69bffd307f 100644
--- a/.github/workflows/find-secrets.yml
+++ b/.github/workflows/find-secrets.yml
@@ -44,6 +44,6 @@ jobs:
 
       - name: Scan diff for secrets with TruffleHog
         # Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags.
-        uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
         with:
           extra_args: --results=verified,unknown