diff --git a/docs/jeannie.1.md b/docs/jeannie.1.md
index 90f19b0..b88a558 100644
--- a/docs/jeannie.1.md
+++ b/docs/jeannie.1.md
@@ -149,6 +149,9 @@ on first. This command is report-only.
 `security-trivy`
 : Run only Trivy filesystem and IaC/config scans.
 
+`security-secrets`
+: Run only gitleaks secret scanning against this repo.
+
 `security-nuclei`
 : Run low-rate nuclei HTTP exposure scans against public targets.
 
diff --git a/jeannie b/jeannie
index 7ecca1a..52c1942 100755
--- a/jeannie
+++ b/jeannie
@@ -5790,6 +5790,11 @@ security_trivy() {
     "${REPO_ROOT}/scripts/security-scan" trivy
 }
 
+security_secrets() {
+    require_debian_server "security-secrets"
+    "${REPO_ROOT}/scripts/security-scan" secrets
+}
+
 security_nuclei() {
     require_debian_server "security-nuclei"
     "${REPO_ROOT}/scripts/security-scan" nuclei
@@ -5919,6 +5924,9 @@ case "${1:-}" in
     security-trivy)
         security_trivy
         ;;
+    security-secrets)
+        security_secrets
+        ;;
     security-nuclei)
         security_nuclei
         ;;
@@ -5936,7 +5944,7 @@ case "${1:-}" in
         echo "Log: ${JEANNIE_LOG_FILE}"
         ;;
     *)
-        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|doctor-preapply|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|security-scan|security-prepare|security-zap|security-k8s|security-host|security-trivy|security-nuclei|security-web|openwrt|nuke}"
+        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|doctor-preapply|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|security-scan|security-prepare|security-zap|security-k8s|security-host|security-trivy|security-secrets|security-nuclei|security-web|openwrt|nuke}"
         exit 1
         ;;
 esac
diff --git a/scripts/security-scan b/scripts/security-scan
index 06f807f..52a0fc1 100755
--- a/scripts/security-scan
+++ b/scripts/security-scan
@@ -9,6 +9,7 @@ TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy:latest}"
 ZAP_IMAGE="${ZAP_IMAGE:-ghcr.io/zaproxy/zaproxy:stable}"
 KUBE_BENCH_IMAGE="${KUBE_BENCH_IMAGE:-aquasec/kube-bench:latest}"
 NUCLEI_IMAGE="${NUCLEI_IMAGE:-projectdiscovery/nuclei:latest}"
+GITLEAKS_IMAGE="${GITLEAKS_IMAGE:-ghcr.io/gitleaks/gitleaks:latest}"
 
 truthy() {
     case "${1,,}" in
@@ -23,7 +24,7 @@ truthy() {
 
 usage() {
     cat <<'EOF'
-Usage: scripts/security-scan {all|prepare|trivy|zap|kube-bench|nuclei|host|web}
+Usage: scripts/security-scan {all|prepare|trivy|zap|kube-bench|nuclei|host|web|secrets}
 
 Environment:
   SECURITY_REPORT_DIR    Report output directory.
@@ -57,6 +58,7 @@ prepare_security_scans() {
         "${ZAP_IMAGE}"
         "${KUBE_BENCH_IMAGE}"
         "${NUCLEI_IMAGE}"
+        "${GITLEAKS_IMAGE}"
     )
 
     ensure_report_dir
@@ -109,6 +111,35 @@ run_trivy() {
     echo "Trivy reports written to ${SECURITY_REPORT_DIR}"
 }
 
+run_gitleaks() {
+    local stamp
+    local report_file
+    stamp="$(timestamp)"
+    ensure_report_dir
+    report_file="${SECURITY_REPORT_DIR}/gitleaks-${stamp}.json"
+
+    echo "Running gitleaks secret scan against this repo..."
+    if command -v gitleaks >/dev/null 2>&1; then
+        gitleaks detect \
+            --source "${REPO_ROOT}" \
+            --report-format json \
+            --report-path "${report_file}" \
+            --redact
+    else
+        require_docker
+        docker run --rm \
+            -v "${REPO_ROOT}:/repo:ro" \
+            -v "${SECURITY_REPORT_DIR}:/reports:rw" \
+            "${GITLEAKS_IMAGE}" detect \
+            --source /repo \
+            --report-format json \
+            --report-path "/reports/gitleaks-${stamp}.json" \
+            --redact
+    fi
+
+    echo "gitleaks report: ${report_file}"
+}
+
 scan_targets() {
     local target_override="$1"
 
@@ -483,6 +514,7 @@ EOF
 case "${1:-all}" in
     all)
         run_trivy
+        run_gitleaks
         run_zap
         ;;
     prepare)
@@ -491,6 +523,9 @@ case "${1:-all}" in
     trivy)
         run_trivy
         ;;
+    secrets)
+        run_gitleaks
+        ;;
     zap)
         run_zap
         ;;
diff --git a/security/README.md b/security/README.md
index faa149a..624e759 100644
--- a/security/README.md
+++ b/security/README.md
@@ -17,6 +17,7 @@ Use Jeannie from the Debian homelab host:
 The default `security-scan` runs:
 
 - Trivy filesystem and IaC/config scans against this repo.
+- gitleaks secret scans against this repo.
 - OWASP ZAP baseline passive scans against `security/targets.txt`.
 
 The focused commands are:
@@ -28,6 +29,7 @@ The focused commands are:
 - `security-host`: Lynis host audit summary for Debian. This command is
   report-only and prints one highest-risk finding to focus on first.
 - `security-trivy`: Trivy repo and IaC/config scans only.
+- `security-secrets`: gitleaks repo secret scan only.
 - `security-nuclei`: low-rate nuclei HTTP exposure scans only.
 - `security-web`: quick HTTPS, status, and defensive-header checks for owned
   web targets.