diff --git a/.github/workflows/security-hardening.yml b/.github/workflows/security-hardening.yml
index 6c4ecfc..aefb63d 100644
--- a/.github/workflows/security-hardening.yml
+++ b/.github/workflows/security-hardening.yml
@@ -22,7 +22,7 @@ jobs:
     # SHA-pinned rather than tag-pinned for supply-chain safety: a tag can be moved, a commit cannot.
     # Dependabot bumps this SHA and names the tag it resolves to in the PR title, so read the version there
     # rather than trusting a hand-written one here (this comment claimed v1.11.0 through three bumps past it).
-    uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@cc7ef8e7de85340368bf74e7c617e1a8f08ff5bb
+    uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@6040db47e31f4db533967c3a5b70f4a208afead3
     with:
       scanners: codeql,gitleaks,osv,dependency-review
       enable_code_security: true