diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index 721cd10b404..ea3167a2334 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -1,4 +1,5 @@
 name: 'Dependency Review'
+
 on:
   push:
     branches:
@@ -10,4 +11,5 @@ permissions:
 
 jobs:
   check:
-    uses: eclipse-edc/.github/.github/workflows/dependency-check.yml@main
\ No newline at end of file
+    uses: eclipse-edc/.github/.github/workflows/dependency-check.yml@main
+    secrets: inherit
diff --git a/DEPENDENCIES b/DEPENDENCIES
index d0e07d4b7d5..5b133afae56 100644
--- a/DEPENDENCIES
+++ b/DEPENDENCIES
@@ -80,7 +80,7 @@ maven/mavencentral/com.jcraft/jzlib/1.1.3, BSD-2-Clause, approved, CQ6218
 maven/mavencentral/com.lmax/disruptor/3.4.4, Apache-2.0, approved, clearlydefined
 maven/mavencentral/com.networknt/json-schema-validator/1.0.76, Apache-2.0, approved, CQ22638
 maven/mavencentral/com.nimbusds/nimbus-jose-jwt/9.28, Apache-2.0, approved, clearlydefined
-maven/mavencentral/com.nimbusds/nimbus-jose-jwt/9.37.3, Apache-2.0, approved, #11701
+maven/mavencentral/com.nimbusds/nimbus-jose-jwt/9.38, , restricted, clearlydefined
 maven/mavencentral/com.puppycrawl.tools/checkstyle/10.16.0, , restricted, clearlydefined
 maven/mavencentral/com.samskivert/jmustache/1.15, BSD-2-Clause, approved, clearlydefined
 maven/mavencentral/com.squareup.okhttp3/okhttp-dnsoverhttps/4.12.0, Apache-2.0, approved, #11159
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 30c5dc93e3d..eb45726c0ee 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -24,7 +24,7 @@ junit-pioneer = "2.2.0"
 jupiter = "5.10.2"
 micrometer = "1.12.5"
 mockito = "5.2.0"
-nimbus = "9.37.3"
+nimbus = "9.38"
 okhttp = "4.12.0"
 opentelemetry = "1.32.0"
 opentelemetry-proto = "1.2.0-alpha"