diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a40ec32..c1909be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,6 +62,6 @@ jobs:
       - name: bandit (Python SAST)
         run: uv run bandit -r scripts -c pyproject.toml
       - name: gitleaks (secret scan)
-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}