diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 1477319b4..4b585d659 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -24,9 +24,6 @@ jobs:
         uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1
         with:
           check-mode: pull_request
-  pr-check-hadcoded-secrets:
-    name: "Check PR for hardcoded secrets"
-    uses: mParticle/mparticle-workflows/.github/workflows/security-hardcoded-secrets.yml@main
 
   instrumented-core:
     uses: ./.github/workflows/instrumented-tests.yml
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 012775cc9..4e1b1783e 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -35,6 +35,10 @@ lint:
     - shellcheck@0.11.0
     - shfmt@3.6.0
     - trufflehog@3.90.6
+    # Scans the commits a PR adds (--since-commit ${upstream-ref}), which catches
+    # secrets that were committed and then removed later on the same branch --
+    # the working-tree scan above cannot see those.
+    - trufflehog-git@3.90.6
     - mparticle-api-key-check # Custom rule to prevent mParticle API keys from being committed
   definitions:
     - name: mparticle-api-key-check