diff --git a/.github/workflows/test-template.yml b/.github/workflows/test-template.yml
index 2eb6cbe..d2957e6 100644
--- a/.github/workflows/test-template.yml
+++ b/.github/workflows/test-template.yml
@@ -108,7 +108,7 @@ jobs:
         run: uvx semgrep@1.167.0 scan --config .semgrep.yml --metrics=off --error .
       # gitleaks is installed from the mise.toml pin (single source of truth);
       # install: false brings up the mise CLI only.
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install: false
       - name: gitleaks