diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index b68032f..b0a803c 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -29,7 +29,7 @@ jobs:
       - name: TruffleHog OSS
         # Pinned to a release commit. The scanner image itself still defaults
         # to "latest" so new detectors arrive without a workflow change.
-        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 # v3.99.7
+        uses: trufflesecurity/trufflehog@ea68ca03c865c5f324e86e849ced20ed3cf9dbbb # v3.99.8
         with:
           # On push: scan only the new commits in this push
           # On PR: scan only the commits added by the PR branch