diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 932fd73..5eb6412 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: TruffleHog OSS
         id: trufflehog
-        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b # v3.97.1
+        uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c # v3.97.4
         with:
           path: ./
           base: ${{ steps.scan_range.outputs.base }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index beb3424..a06806d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## v0.14.9 - Unreleased
 
+- Refresh the pinned TruffleHog secret-scanning action to v3.97.4. Thanks @dependabot.
+
 ## v0.14.8 - 2026-08-30
 
 - Default release checks to a 30-second HTTP timeout so unresponsive servers cannot hang checks indefinitely.