diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 0000000..549036c
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,19 @@
+name: secret-scan
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  gitleaks:
+    runs-on: stable-diffution-webui-rcom-runner
+    permissions:
+      contents: read
+      pull-requests: read  # gitleaks-action lists PR commits via the API
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0  # full history for PR diff scans
+      - uses: gitleaks/gitleaks-action@v2.3.7  # pin the tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..31dcb62
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,5 @@
+# Vendored: inherit gitleaks v8.30.1 default rule set. Includes the
+# kubernetes-secret-yaml rule that catches the homelab antipattern.
+# Future homelab-specific rules go below the [extend] block.
+[extend]
+useDefault = true