diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 41f7a7b..e081ab7 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -53,6 +53,6 @@ jobs:
       - name: Enforce local randomness rules (entropy audit §13)
         run: semgrep scan --config .semgrep.yml --error --timeout 0 packages
       - name: Scan repository history for secrets
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}