diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..419b1ad
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,7 @@
+# Hooks for this repository. Generated projects get
+# template/.pre-commit-config.yaml.jinja instead.
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e  # frozen: v8.30.1
+  hooks:
+  - id: gitleaks
diff --git a/README.md b/README.md
index 5ae860a..7eaf1ca 100644
--- a/README.md
+++ b/README.md
@@ -15,3 +15,8 @@ uvx copier copy git@github.com:XomniaAI/python-project-template.git <path>
 ```
 
 Replace `<path>` with your desired project directory.
+
+## Development
+
+Run `uvx pre-commit install` once. It installs a gitleaks hook that scans
+staged changes for secrets on every commit.
diff --git a/template/.pre-commit-config.yaml.jinja b/template/.pre-commit-config.yaml.jinja
index a37c47d..ba5fd8c 100644
--- a/template/.pre-commit-config.yaml.jinja
+++ b/template/.pre-commit-config.yaml.jinja
@@ -14,11 +14,10 @@ repos:
   - id: yamllint
     args: [-d, "{extends: relaxed, rules: {line-length: disable} }"]
     verbose: true
-- repo: https://github.com/Yelp/detect-secrets
-  rev: v1.5.0
+- repo: https://github.com/gitleaks/gitleaks
+  rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e  # frozen: v8.30.1
   hooks:
-  - id: detect-secrets
-    exclude: ^\.venv/
+  - id: gitleaks
 - repo: https://github.com/kynan/nbstripout
   rev: '0.9.1'
   hooks: