diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index a73d923a..a0eaf162 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -171,7 +171,7 @@ jobs:
 
       # ---------- Security scanning ----------
       - name: Scan for secrets and credentials
-        uses: trufflesecurity/trufflehog@v3.95.9
+        uses: trufflesecurity/trufflehog@v3.96.0
         continue-on-error: true
         with:
           path: ./
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index c51fdacb..589c614f 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -133,7 +133,7 @@ jobs:
         # All other actions in this repo follow the same "current major"
         # convention (actions/checkout@v4, docker/setup-buildx-action@v4,
         # docker/build-push-action@v7, docker/metadata-action@v5).
-        uses: dorny/paths-filter@v4.0.2
+        uses: dorny/paths-filter@v4.0.3
         with:
           filters: .github/paths-filter.yml
 
diff --git a/.github/workflows/pre-approval-checks.yml b/.github/workflows/pre-approval-checks.yml
index 66d0641b..7158eeb6 100644
--- a/.github/workflows/pre-approval-checks.yml
+++ b/.github/workflows/pre-approval-checks.yml
@@ -24,7 +24,7 @@ jobs:
 
       - name: Security Scan - Secrets Detection
         id: secrets-scan
-        uses: trufflesecurity/trufflehog@v3.95.9
+        uses: trufflesecurity/trufflehog@v3.96.0
         with:
           path: ./
           base: ${{ github.event.before || '' }}