diff --git a/.github/workflows/secscan.yaml b/.github/workflows/secscan.yaml
index b5bf8e2bed6a..e46d299037b2 100644
--- a/.github/workflows/secscan.yaml
+++ b/.github/workflows/secscan.yaml
@@ -18,7 +18,7 @@ jobs:
         if: ${{ github.actor != 'dependabot[bot]' }}
       - name: Run Gosec Security Scanner
         if: ${{ github.actor != 'dependabot[bot]' }}
-        uses: securego/gosec@v2.27.1
+        uses: securego/gosec@v2.28.0
         with:
           # we let the report trigger content trigger a failure using the GitHub Security features.
           # backend/go/supertonic is excluded: it vendors upstream supertone-inc/supertonic