diff --git a/.gitignore b/.gitignore
index 621e91f..3c4af8b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,8 @@ Thumbs.db
 
 # Design docs
 *-design-*.md
+
+# Gitleaks config (symlink to shared config)
+.gitleaks.toml
+
+.gitleaksbaseline.json
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..abe3316
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,6 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.24.0
+    hooks:
+      - id: gitleaks
+        args: ['--baseline-path', '.gitleaksbaseline.json']