diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 1bfca43..4881611 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -20,6 +20,6 @@ jobs:
           fetch-depth: 0
 
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3
+        uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3
         with:
           extra_args: --only-verified --fail
diff --git a/gitlab-bridge/src/forges/ForgeAdapter.res b/gitlab-bridge/src/forges/ForgeAdapter.res
index ca0688e..5b7c8fb 100644
--- a/gitlab-bridge/src/forges/ForgeAdapter.res
+++ b/gitlab-bridge/src/forges/ForgeAdapter.res
@@ -71,6 +71,9 @@ type repository = {
   fullName: string,
   description: option<string>,
   defaultBranch: string,
+  // `private` is a reserved keyword in ReScript 12, so the variant
+  // tag is quoted. JSON serialization remains "private" — no
+  // wire-format change.
   visibility: [#public | #"private" | #internal],
   url: string,
   cloneUrl: string,