diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index d39fad2d..de3a611c 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: TruffleHog OSS
         id: trufflehog
-        uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
+        uses: trufflesecurity/trufflehog@0186870afd2c4a90def791d80260923ba583d076 # v3.98.0
         with:
           path: ./
           base: ${{ steps.scan_range.outputs.base }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 218cfc0f..0ad31149 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Update the TruffleHog secret-scanning action to v3.98.0. Thanks @dependabot.
+
 - Update the indirect `go-strftime` dependency to v1.1.0, retaining the existing Go runtime floor.
 
 - Load the analytics discovery receipt beside the resolved config, including `GITCRAWL_CONFIG`, instead of the working directory. Thanks @SebTardif.