diff --git a/gen/secrets.baseline.json b/gen/secrets.baseline.json
index c7a6c09cf6..16a72c3a14 100644
--- a/gen/secrets.baseline.json
+++ b/gen/secrets.baseline.json
@@ -125,14 +125,14 @@
         "filename": "infra/nix/bolt/default.nix",
         "hashed_secret": "7096ce78355a7fc302686472413e82c32dcd89cc",
         "is_verified": false,
-        "line_number": 51
+        "line_number": 55
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "infra/nix/bolt/default.nix",
         "hashed_secret": "80a11fe90031acb43c4de1afdc8fee4bb665d183",
         "is_verified": false,
-        "line_number": 52
+        "line_number": 56
       }
     ],
     "infra/nix/pkgs/clickhouse.nix": [
@@ -244,5 +244,5 @@
       }
     ]
   },
-  "generated_at": "2024-03-01T02:26:18Z"
+  "generated_at": "2024-04-11T21:32:47Z"
 }
diff --git a/shell.nix b/shell.nix
index 9c4d19fdef..16cceb7182 100644
--- a/shell.nix
+++ b/shell.nix
@@ -46,6 +46,7 @@ in
 
 			# Runtimes
 			nodejs  # Required for Fern
+			python310Packages.detect-secrets
 
 			# Compilers
 			clang
@@ -75,7 +76,7 @@ in
 		);
 		shellHook = ''
 			# Setup Git LFS
-			git lfs install > /dev/null
+			git lfs install --manual > /dev/null
 
 			# Add binaries to path so we can use a locally built copy of Bolt.
 			export PATH="${toString ./target/debug/.}:${toString ./target/release/.}:$PATH"