diff --git a/ci/setup-tools.sh b/ci/setup-tools.sh
index c24ca8de..b0ea36ac 100644
--- a/ci/setup-tools.sh
+++ b/ci/setup-tools.sh
@@ -19,8 +19,8 @@ OSV_SCANNER_VERSION="${OSV_SCANNER_VERSION:-v2.4.0}"
 OSV_SCANNER_SHA256="${OSV_SCANNER_SHA256:-15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0}"
 
 # renovate: datasource=github-release-attachments depName=opengrep/opengrep
-OPENGREP_VERSION="${OPENGREP_VERSION:-v1.25.0}"
-OPENGREP_SHA256="${OPENGREP_SHA256:-9ac4aebb47ba3f7b0d8fc641ac8749cb6c2f253f616131a67d9631e00d4bea33}"
+OPENGREP_VERSION="${OPENGREP_VERSION:-v1.28.0}"
+OPENGREP_SHA256="${OPENGREP_SHA256:-85af2f34e5175995acbc431e1ca733e34062aad9640ad4308422abe1968b84cf}"
 
 # renovate: datasource=github-tags depName=semgrep/semgrep-rules
 SEMGREP_RULES_REF="${SEMGREP_RULES_REF:-40b8c63f75dc7c22c8a77482d73bfb864b146f7e}"