diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml
index 24f4c36b..00243470 100644
--- a/.gitea/workflows/release-gates.yml
+++ b/.gitea/workflows/release-gates.yml
@@ -24,10 +24,19 @@ jobs:
         with:
           fetch-depth: 0
       - name: Secret scan
-        uses: trufflesecurity/trufflehog@v3.79.0
-        with:
-          path: ./
-          extra_args: --only-verified
+        shell: bash
+        run: |
+          set -euo pipefail
+          repository="$PWD"
+          source="file:///repo"
+          workspace=(-v "$repository:/repo" -w /repo)
+          if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
+            source="file://$repository"
+            workspace=(--volumes-from "$HOSTNAME" -w "$repository")
+          fi
+          docker run --rm "${workspace[@]}" \
+            ghcr.io/trufflesecurity/trufflehog@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3 \
+            git "$source" --fail --no-update --github-actions --only-verified
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"