diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 000000000..a2d9dcb94
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,46 @@
+name: Gitleaks Secret Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      # Keep in sync with the gitleaks rev in .pre-commit-config.yaml.
+      GITLEAKS_VERSION: 8.30.1
+      GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          # Full history is required so gitleaks can scan past commits, not just the working tree.
+          fetch-depth: 0
+
+      # gitleaks/gitleaks-action requires a paid license for organization-owned repos
+      # (device-management-toolkit is an org); the underlying gitleaks CLI itself is
+      # still fully free/OSS, so install and run it directly instead.
+      - name: Install gitleaks
+        run: |
+          curl -sSfLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "${GITLEAKS_SHA256}  gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | sha256sum -c -
+          tar -xzf "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" gitleaks
+          chmod +x gitleaks
+
+      - name: Run Gitleaks
+        run: ./gitleaks git . -v --exit-code 1
+
diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 000000000..9b7531537
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,24 @@
+# Known findings from historical commits that are test-only / example secrets.
+# These cannot be scrubbed without rewriting published git history, so they are
+# allowlisted by fingerprint instead. See CONTRIBUTING.md before adding new entries.
+043d98afe92215d5e527471107bc2661c890a09b:config/config.yml:generic-api-key:5
+76d223b0887b041290239104172f7f47aef95258:config/encryption_key_test.go:generic-api-key:103
+76d223b0887b041290239104172f7f47aef95258:cmd/app/main_test.go:generic-api-key:137
+de7cc90c4d01d53bdb0c5a9cdfae0f96aacec1c9:integration-test/mcp/README.md:generic-api-key:20
+e4e33d2a662f73788cb7583141d67451d5b78d3a:docker-compose.yml:generic-api-key:68
+921de614c0e221fb311ad67746d31c7cac531a37:redfish/internal/controller/http/v1/generated/spec.gen.go:generic-api-key:165
+65f4c902a07c06e7b31ed47dcb6f34048ff833be:redfish/internal/usecase/sessions/usecase_fuzz_test.go:jwt:201
+bb5af18ce42f82bc0fd229d956222867accd0788:integration-test/collections/console_rps_apis.postman_collection.json:jwt:8355
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6102
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6173
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6257
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6334
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6394
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6447
+693297fd2604a083b55fabf262553df6b6a02f99:integration-test/collections/console_rps_apis.postman_collection.json:jwt:6507
+29dfc8790fb4e2ef704d172e4db44f1838664cba:docker-compose.yml:generic-api-key:24
+3d2e033dfad871d5168417723f18925db71b5a82:integration-test/collections/console_mps_apis.postman_collection.json:jwt:133
+3d2e033dfad871d5168417723f18925db71b5a82:integration-test/collections/console_mps_apis.postman_collection.json:jwt:185
+3d2e033dfad871d5168417723f18925db71b5a82:integration-test/collections/console_mps_apis.postman_collection.json:jwt:246
+ded37b9f8053036da4b2b86d6c710caaaa456f76:internal/features/explorer/explorer.go:generic-api-key:760
+f637525448144ec424bc7daea2415fd58257c717:integration-test/console.postman_collection.json:jwt:11692
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2bcee974a..194b981f3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/gitleaks/gitleaks
-  rev: v8.16.3
+  rev: v8.30.1
   hooks:
   - id: gitleaks
 - repo: https://github.com/golangci/golangci-lint