diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 3b0284f..169c612 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -19,14 +19,14 @@ jobs:
     # Pinned to a commit SHA (not @main) per the org's own pinGitHubActionDigests convention —
     # a moving branch ref would let a compromised or unexpectedly-changed org workflow silently
     # run in this repo's CI. Bump deliberately: re-check cfdude/.github before updating the SHA.
-    uses: cfdude/.github/.github/workflows/security-semgrep.yml@78d5710aa7aa61e40afd490b8192bd44f931759c  # main @ 2026-07-20
+    uses: cfdude/.github/.github/workflows/security-semgrep.yml@8931286eb4057e4a2829325c1e04e6071ebf3ff4  # main @ 2026-07-30
     permissions:
       contents: read
       security-events: write
 
   trivy:
     name: Trivy filesystem scan
-    uses: cfdude/.github/.github/workflows/security-trivy.yml@78d5710aa7aa61e40afd490b8192bd44f931759c  # main @ 2026-07-20
+    uses: cfdude/.github/.github/workflows/security-trivy.yml@8931286eb4057e4a2829325c1e04e6071ebf3ff4  # main @ 2026-07-30
     permissions:
       contents: read
       security-events: write