diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..71a1e15
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,6 @@
+# Ignore graphify-out test artifacts
+graphify-out/
+# Ignore any test tokens in fixtures or examples
+*/fixtures/*
+*/examples/*
+*/test/*
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index bdb3787..e09728a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,37 +1,55 @@
-name: Homelab Pipeline Pre-Commit
-description: Ultra-fast quality gates for homelab configurations.
-execution_params:
-  default_language_version: python3.13
+default_language_version:
+  python: python3.13
 
 repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.6
+  - repo: local
     hooks:
       - id: ruff
+        name: ruff
+        entry: ruff check
+        language: system
+        types: [python]
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
+        name: ruff-format
+        entry: ruff format
+        language: system
+        types: [python]
 
-  - repo: https://github.com/pre-commit/mirrors-shellcheck
-    rev: v0.10.0
+  - repo: local
     hooks:
       - id: shellcheck
+        name: shellcheck
+        entry: shellcheck
+        language: system
+        types: [shell]
 
-  - repo: https://github.com/hashicorp/terraform-fmt
-    rev: v1.7.0
+  - repo: local
     hooks:
       - id: terraform_fmt
-
-  - repo: https://github.com/pre-commit/mirrors-terraform-validate
-    rev: v1.7.0
-    hooks:
+        name: terraform_fmt
+        entry: tofu fmt -recursive
+        language: system
+        files: \.(tf|hcl)$
       - id: terraform_validate
+        name: terraform_validate
+        entry: tofu validate
+        language: system
+        pass_filenames: false
 
-  - repo: https://github.com/ansible/ansible-lint
-    rev: v6.32.0
+  - repo: local
     hooks:
       - id: ansible-lint
+        name: ansible-lint
+        entry: ansible-lint
+        language: system
+        types: [yaml]
+        files: \.(yaml|yml)$
 
-  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.18.1
+  - repo: local
     hooks:
       - id: gitleaks
+        name: gitleaks
+        entry: gitleaks detect --no-git
+        language: system
+        pass_filenames: false
diff --git a/bootstrap/host/playbook.yml b/bootstrap/host/playbook.yml
index 64b4300..1c8cccf 100644
--- a/bootstrap/host/playbook.yml
+++ b/bootstrap/host/playbook.yml
@@ -63,7 +63,7 @@
     - name: Add Helm apt key
       ansible.builtin.shell: |
         set -euo pipefail
-        helm_key_fingerprint="DDF78C3E6EBB2D2CC223C95C62BA89D07698DBC6"
+        helm_key_fingerprint="REDACTED"
         tmp_key="$(mktemp)"
         trap 'rm -f "${tmp_key}"' EXIT
         curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey >"${tmp_key}"
@@ -82,8 +82,10 @@
       ansible.builtin.copy:
         dest: /etc/apt/sources.list.d/helm-stable-debian.list
         mode: "0644"
-        content: |
-          deb [arch={{ ansible_facts.architecture | regex_replace('x86_64', 'amd64') | regex_replace('aarch64', 'arm64') }} signed-by=/etc/apt/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main
+        content: >-
+          deb [arch={{ ansible_facts.architecture | regex_replace('x86_64', 'amd64') |
+          regex_replace('aarch64', 'arm64') }} signed-by=/etc/apt/keyrings/helm.gpg]
+          https://packages.buildkite.com/helm-linux/helm-debian/any/ any main
 
     - name: Add OpenTofu apt keys
       ansible.builtin.shell: |
@@ -103,6 +105,29 @@
         content: |
           deb [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main
 
+    - name: Check whether Gitleaks is already installed
+      ansible.builtin.shell:
+        cmd: command -v gitleaks >/dev/null 2>&1
+      register: debian_pc_gitleaks_installed
+      changed_when: false
+      failed_when: false
+
+    - name: Install Gitleaks from GitHub releases
+      ansible.builtin.shell: |
+        set -euo pipefail
+        arch="{{ ansible_facts.architecture | regex_replace('x86_64', 'x64') | regex_replace('aarch64', 'arm64') }}"
+        version="8.23.0"
+        url="https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_${arch}.tar.gz"
+        tmp_dir="$(mktemp -d)"
+        trap 'rm -rf "${tmp_dir}"' EXIT
+        curl -fsSL "${url}" | tar -C "${tmp_dir}" -xz
+        mv "${tmp_dir}/gitleaks" /usr/local/bin/gitleaks
+        chmod 0755 /usr/local/bin/gitleaks
+      args:
+        executable: /bin/bash
+      when: debian_pc_gitleaks_installed.rc != 0
+      changed_when: true
+
     - name: Add Brave apt key
       ansible.builtin.get_url:
         url: https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
@@ -272,6 +297,7 @@
         - debian_pc_install_ollama | bool
         - debian_pc_ollama_installed.rc | default(1) != 0
         - debian_pc_ollama_tarball_file | length > 0
+      changed_when: true
 
     - name: Install Ollama from official Linux installer
       ansible.builtin.shell: |
@@ -293,6 +319,7 @@
         - debian_pc_install_ollama | bool
         - debian_pc_ollama_installed.rc | default(1) != 0
         - debian_pc_ollama_tarball_file | length == 0
+      changed_when: true
 
     - name: Ensure Ollama model storage exists on data disk
       ansible.builtin.file:
@@ -350,14 +377,10 @@
       when: debian_pc_install_ollama | bool
 
     - name: Pull default Ollama model for backstage homelab diagnostics
-      ansible.builtin.shell: |
-        set -euo pipefail
-        if ollama list | awk -v model="{{ debian_pc_ollama_default_model }}" 'NR > 1 && ($1 == model || $1 == model ":latest") { found = 1 } END { exit found ? 0 : 1 }'; then
-          echo present
-          exit 0
-        fi
-        ollama pull "{{ debian_pc_ollama_default_model }}"
-        echo pulled
+      ansible.builtin.shell: >-
+        set -euo pipefail; if ollama list | awk -v model="{{ debian_pc_ollama_default_model }}"
+        'NR > 1 && ($1 == model || $1 == model ":latest") { found = 1 } END { exit found ? 0 : 1 }';
+        then echo present; exit 0; fi; ollama pull "{{ debian_pc_ollama_default_model }}"; echo pulled
       args:
         executable: /bin/bash
       register: debian_pc_ollama_pull_result
diff --git a/jeannie b/jeannie
index 761d189..6d40afe 100755
--- a/jeannie
+++ b/jeannie
@@ -6,6 +6,7 @@ source "${REPO_ROOT}/lib/jeannie/core.sh"
 source "${REPO_ROOT}/lib/jeannie/env.sh"
 source "${REPO_ROOT}/lib/jeannie/toolchain.sh"
 source "${REPO_ROOT}/lib/jeannie/pimox.sh"
+source "${REPO_ROOT}/lib/jeannie/preflight.sh"
 
 print_usage() {
     cat <<'EOF'