diff --git a/flake.nix b/flake.nix
index 49eddf5..838e267 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,7 @@
         devShells.default = pkgs.mkShell {
           buildInputs = [
             pkgs.go-task
+            pkgs.gitleaks
           ];
 
           packages = [ pkgs.lefthook pkgs.terraform ];
diff --git a/lefthook.yml b/lefthook.yml
index f32c417..fb035ab 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -11,3 +11,6 @@ pre-commit:
     ruff:
       glob: "*.py"
       run: ruff format .
+    gitleaks:
+      run: gitleaks git --pre-commit --redact --staged --verbose --no-banner
+      fail_text: Staged changes contain a secret. Remove it; never commit and revert.