diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index cb0601c..a27b28a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -89,3 +89,7 @@ jobs:
         with:
           fail-on-severity: high
           deny-licenses: GPL-3.0, AGPL-3.0
+          # TruffleHog (AGPL-3.0) is run unmodified as a CI scanner; it is not
+          # linked into or shipped with anything, so the licence's obligations
+          # do not reach this repository. Only this package is exempt.
+          allow-dependencies-licenses: pkg:githubactions/trufflesecurity/trufflehog