diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index a9fbcbae49..124c2a86f9 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -409,7 +409,7 @@ jobs:
       # ─────────────────────────────────────────────────────────────
       - name: Trivy (filesystem CVE + IaC misconfig)
         continue-on-error: true
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -444,7 +444,7 @@ jobs:
       # ─────────────────────────────────────────────────────────────
       - name: TruffleHog (secrets in diff)
         continue-on-error: true
-        uses: trufflesecurity/trufflehog@v3.83.5
+        uses: trufflesecurity/trufflehog@v3.95.2
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || '' }}