diff --git a/.lefthook/pre-commit/secret-scan.sh b/.lefthook/pre-commit/secret-scan.sh
new file mode 100755
index 0000000..56029cd
--- /dev/null
+++ b/.lefthook/pre-commit/secret-scan.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Secret scan — called by lefthook pre-commit hook.
+# Scans staged files with gitleaks to block secrets from being committed.
+# Skipped during merge/rebase (configured in lefthook.yml).
+
+set -euo pipefail
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "ERROR: gitleaks is not installed." >&2
+  echo "  Install it via mise, brew, or download from https://github.com/gitleaks/gitleaks" >&2
+  echo "  Override with git commit --no-verify if needed." >&2
+  exit 1
+fi
+
+gitleaks protect --staged --verbose
diff --git a/README.md b/README.md
index 15c15a9..3aec28b 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,9 @@ A starter template for new GitHub repositories.
 This template includes `lefthook.yml` for git hook management.
 
 ```bash
-# Install lefthook (via mise or your package manager)
+# Install lefthook and gitleaks (via mise or your package manager)
 mise use lefthook
+mise use gitleaks
 
 # Install hooks into .git/hooks/
 lefthook install
@@ -35,6 +36,7 @@ lefthook install
 
 Hooks configured:
 - **pre-commit**: runs `npm run lint` if package.json exists (skips merge/rebase)
+- **pre-commit**: scans staged files with gitleaks to block secrets (skips merge/rebase)
 - **commit-msg**: enforces `type(scope): summary` commit message format via `.lefthook/commit-msg/commit-msg-lint.sh`
 
 Scripts live under `.lefthook/<hook-name>/`. Override with `git commit --no-verify` when needed.
diff --git a/lefthook.yml b/lefthook.yml
index cf1d140..dfd0c34 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -6,6 +6,11 @@
 
 pre-commit:
   commands:
+    secret-scan:
+      run: bash .lefthook/pre-commit/secret-scan.sh
+      skip:
+        - merge
+        - rebase
     lint:
       run: |
         # Run project lint if available