diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..0007830
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,14 @@
+# Gitleaks configuration for this monorepo.
+# Docs: https://github.com/gitleaks/gitleaks#configuration
+
+title = "gitleaks config"
+
+[extend]
+# Use the upstream default ruleset as the base.
+useDefault = true
+
+[allowlist]
+description = "Test fixtures in __seeds__ directories use token-shaped dummy strings that are not real credentials."
+paths = [
+  '''__seeds__/''',
+]
diff --git a/.husky/pre-commit b/.husky/pre-commit
index 92c418a..e8d39f8 100755
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -19,3 +19,10 @@ node scripts/work/state-sync-guard.mjs || exit 1
 
 # 4. Check library decision traces for new runtime deps in feature/core packages.
 node scripts/library-decisions/check.mjs || exit 1
+
+# 5. Scan staged changes for secrets (skip gracefully if gitleaks is not installed).
+if command -v gitleaks > /dev/null 2>&1; then
+  gitleaks protect --staged --redact || exit 1
+else
+  echo "gitleaks not found in \$PATH — skipping secret scan (install via brew install gitleaks or https://github.com/gitleaks/gitleaks)"
+fi