diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 44032e7..1dd1e84 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -22,6 +22,6 @@ jobs:
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           extra_args: --only-verified --fail