diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 8d1edcc1..8c465286 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -294,7 +294,7 @@ jobs:
 
       - name: ZAP baseline scan
         if: steps.guard.outputs.ready == 'true'
-        uses: zaproxy/action-baseline@66042c8e7e24680119199a017e5b0e8603bf4dae  # v0.12.0
+        uses: zaproxy/action-baseline@de8ad967d3548d44ef623df22cf95c3b0baf8b25  # v0.15.0
         with:
           # /health rather than `/`, because that is a URL this application has. What the
           # spider can reach from it is one GET: the rest of the surface is POST-only, and