diff --git a/.github/workflows/_reusable-secrets.yml b/.github/workflows/_reusable-secrets.yml
index 3851846..159105b 100644
--- a/.github/workflows/_reusable-secrets.yml
+++ b/.github/workflows/_reusable-secrets.yml
@@ -33,7 +33,7 @@ jobs:
         # every run and break dependent jobs in ci-full). The action always
         # passes --fail, so a finding exits non-zero (code 183).
         continue-on-error: ${{ github.event_name != 'pull_request' }}
-        uses: trufflesecurity/trufflehog@d411fff7b8879a62509f3fa98c07f247ac089a51 # v3.95.5
+        uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6
         with:
           path: ./
           # base/head are omitted so the action derives them from the event: