diff --git a/.github/workflows/security-hardening.yml b/.github/workflows/security-hardening.yml
index 52d4646..7261307 100644
--- a/.github/workflows/security-hardening.yml
+++ b/.github/workflows/security-hardening.yml
@@ -22,7 +22,7 @@ jobs:
     # SHA-pinned rather than tag-pinned for supply-chain safety: a tag can be moved, a commit cannot.
     # Dependabot bumps this SHA and names the tag it resolves to in the PR title, so read the version there
     # rather than trusting a hand-written one here (this comment claimed v1.11.0 through three bumps past it).
-    uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@3fb133a5d03ec81a7a534cf451dd19991e04a975
+    uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@309e971918f9852c4a35e34fa145b5412697829f
     with:
       scanners: codeql,gitleaks,osv,dependency-review
       enable_code_security: true