diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2ca1778..c3eb6256 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to the ld-find-code-refs program will be documented in this
 
 ## [Unreleased]
 
+## [2.18.2] - 2026-09-25
+
+### Fixed:
+- bumped `github.com/pelletier/go-toml/v2` from v2.2.4 to v2.4.3, clearing a reported denial-of-service finding (XRAY-1033007). The module arrives indirectly through `spf13/viper`, which requires v2.2.4, so the 2.18.0 dependency work did not move it. The TOML decoder is not reachable from this program -- `options.go` pins `viper.SetConfigType("yaml")`, so viper never selects the TOML codec -- but the upstream release bounds array and inline-table nesting depth to prevent a stack-overflow crash, so the bump is worth taking regardless
+- the GitHub Action README examples referenced `launchdarkly/find-code-references@v2.18.1`, a tag that was never created. The Action tag and the scanner version are realigned at 2.18.2 so the copy-pasteable examples resolve
+
 ## [2.18.1] - 2026-09-23
 
 ### Fixed:
diff --git a/build/metadata/github-actions/Dockerfile b/build/metadata/github-actions/Dockerfile
index c50f77b3..38a9d10d 100644
--- a/build/metadata/github-actions/Dockerfile
+++ b/build/metadata/github-actions/Dockerfile
@@ -1,4 +1,4 @@
-FROM launchdarkly/ld-find-code-refs-github-action:2.18.1
+FROM launchdarkly/ld-find-code-refs-github-action:2.18.2
 
 LABEL com.github.actions.name="LaunchDarkly Code References"
 LABEL com.github.actions.description="Find references to feature flags in your code."
diff --git a/build/metadata/github-actions/README.md b/build/metadata/github-actions/README.md
index 05c02299..55c54730 100644
--- a/build/metadata/github-actions/README.md
+++ b/build/metadata/github-actions/README.md
@@ -28,7 +28,7 @@ jobs:
       with:
         fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions
     - name: LaunchDarkly Code References
-      uses: launchdarkly/find-code-references@v2.18.1
+      uses: launchdarkly/find-code-references@v2.18.2
       with:
         accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
         projKey: LD_PROJECT_KEY
@@ -64,11 +64,11 @@ jobs:
         password: ${{ secrets.REGISTRY_TOKEN }}
     - name: LaunchDarkly Code References
       # Pin to a release that includes the docker/ entry point (see changelog).
-      uses: launchdarkly/find-code-references/docker@v2.18.1
+      uses: launchdarkly/find-code-references/docker@v2.18.2
       with:
         accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
         projKey: LD_PROJECT_KEY
-        dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1
+        dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.2
 ```
 
 Mirror the public image `launchdarkly/ld-find-code-refs-github-action` into your registry (pin `dockerImage` to the scanner image tag you mirrored; it can lag the Action tag). This entry point requires a Docker CLI on the runner (included on GitHub-hosted `ubuntu-*` runners). Existing workflows that use the root Action do not need to change.
@@ -104,7 +104,7 @@ jobs:
       with:
         fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions
     - name: LaunchDarkly Code References
-      uses: launchdarkly/find-code-references@v2.18.1
+      uses: launchdarkly/find-code-references@v2.18.2
       with:
         accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
         projKey: LD_PROJECT_KEY
diff --git a/build/metadata/github-actions/docker/action.yml b/build/metadata/github-actions/docker/action.yml
index 465d2d96..2eb3def8 100644
--- a/build/metadata/github-actions/docker/action.yml
+++ b/build/metadata/github-actions/docker/action.yml
@@ -52,12 +52,12 @@ inputs:
     description: >-
       Container image to run. Defaults to the public Docker Hub image used by
       the root Action. Set this to your mirrored/proxy image (for example
-      your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1).
+      your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.2).
       Authenticate to private registries with docker/login-action (or equivalent)
       in a prior step. Requires a runner with a Docker CLI (GitHub-hosted
       ubuntu-* runners include one).
     required: false
-    default: "launchdarkly/ld-find-code-refs-github-action:2.18.1"
+    default: "launchdarkly/ld-find-code-refs-github-action:2.18.2"
 runs:
   using: composite
   steps:
diff --git a/internal/version/version.go b/internal/version/version.go
index ebb4ffa7..6832086f 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -1,3 +1,3 @@
 package version
 
-const Version = "2.18.1"
+const Version = "2.18.2"