diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 41b345e..9bacd04 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -15,6 +15,29 @@ permissions:
   pull-requests: read
 
 jobs:
+  gitleaks:
+    name: secrets-scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION="8.22.1"
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | sudo tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Run gitleaks scan
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            gitleaks git --config=.gitleaks.toml --log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" --verbose
+          else
+            gitleaks git --config=.gitleaks.toml --verbose
+          fi
+
   test:
     name: Test
     runs-on: ubuntu-latest
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..02c1975
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,48 @@
+# Gitleaks configuration for shipyard-cli repo
+# Uses gitleaks' 150+ built-in rules; this file only adds allowlists for known safe patterns.
+
+[extend]
+# Use all built-in rules
+useDefault = true
+
+[allowlist]
+description = "Global allowlist for known safe patterns"
+
+paths = [
+    # Dependencies and lock files
+    '''node_modules/''',
+    '''vendor/''',
+    '''pnpm-lock\.yaml$''',
+    '''uv\.lock$''',
+    '''go\.sum$''',
+    '''package-lock\.json$''',
+    '''dist/''',
+    '''\.min\.js$''',
+    '''coverage/''',
+
+    # Generated protobuf code
+    '''_pb2\.py$''',
+
+    # Test files with intentionally fake secrets
+    '''tests/''',
+    '''_test\.go$''',
+    '''testdata/''',
+
+    # Env templates
+    '''\.envrc\.template$''',
+    '''\.envrc\.sample$''',
+    '''\.env\.example$''',
+    '''\.env\.template$''',
+]
+
+regexes = [
+    '''fake-aes-key''',
+    '''fake-secret-key''',
+    '''fake-salt''',
+    '''changeme''',
+    '''placeholder''',
+    '''prom-operator''',
+    '''EXAMPLE[_-]?KEY''',
+    '''(?i)test[_-]?secret''',
+    '''(?i)dummy[_-]?(key|secret|token|password)''',
+]