diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 7921a333..3713930b 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -20,10 +20,14 @@ jobs:
           registry-url: https://registry.npmjs.org/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish --provenance --access public
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
   publish-alpha:
     runs-on: ubuntu-latest
     if: ${{ endsWith(github.event.release.name, '-alpha')  }}
@@ -41,8 +45,12 @@ jobs:
           registry-url: https://registry.npmjs.org/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         # Without --tag alpha npm moves the latest tag to the prerelease
         run: npm publish --tag alpha --provenance --access public
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
diff --git a/.gitignore b/.gitignore
index 6030c9aa..69093137 100644
--- a/.gitignore
+++ b/.gitignore
@@ -145,3 +145,4 @@ test-reports/
 test-profile-report.json
 
 # End of https://www.toptal.com/developers/gitignore/api/node,web,vscode
+.cache_ggshield
diff --git a/package.json b/package.json
index d3ab86cd..8f4fe914 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,8 @@
     ],
     "sideEffects": false,
     "scripts": {
-        "build": "NODE_OPTIONS='--max-old-space-size=16384' tsup",
+            "postpack": "ggshield secret scan archive ./*.tgz",
+    "build": "NODE_OPTIONS='--max-old-space-size=16384' tsup",
         "test": "vitest --run",
         "test:watch": "vitest",
         "test:once": "vitest run",