diff --git a/.gitignore b/.gitignore
index 056cf69d2..93d7878e1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,3 +43,6 @@ DataDir/
 
 *.log
 
+# gitleaks scan output (local secret-scan report, not for the repo)
+gitleaks-report.json
+
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..168ff1424
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,6 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.24.2
+    hooks:
+      - id: gitleaks
+