diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 9e89808e..48736734 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -6,8 +6,13 @@ on:
   pull_request:
     branches: [ main ]
 
+# Least privilege for this workflow (no PR comments from gitleaks-action)
+permissions:
+  contents: read
+
 env:
   PYTHON_VERSION: "3.12"
+  GITLEAKS_VERSION: "8.28.0"
 
 jobs:
   pre-commit:
@@ -17,6 +22,11 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
+      with:
+        # Full history so gitleaks can scan all commits in CI
+        fetch-depth: 0
+        # Do not persist GITHUB_TOKEN in local git config for later steps
+        persist-credentials: false
 
     - name: Install uv
       uses: astral-sh/setup-uv@v3
@@ -33,3 +43,16 @@ jobs:
     - name: Run Pre Commit
       run: |
         source .venv/bin/activate && pre-commit run --all-files
+
+    # The gitleaks pre-commit hook runs `gitleaks git --pre-commit --staged`,
+    # which only scans staged changes. A clean CI checkout has nothing staged.
+    # Use the open-source CLI (no GITLEAKS_LICENSE) and scan full git history.
+    - name: Install Gitleaks
+      run: |
+        curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+          | tar -xz gitleaks
+        sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
+        gitleaks version
+
+    - name: Gitleaks full history scan
+      run: gitleaks git --log-opts="--all" --redact --verbose
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b53e420e..8c87ea85 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,15 @@
+# Install: pip install pre-commit && pre-commit install
+#   (or: make install)
+# Run manually: pre-commit run --all-files
+#
+# Secret scanning: gitleaks + detect-private-key (same approach as usernaut / template-ui).
+# Also enable GitHub Secret Scanning + Push Protection on the repo:
+# https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning
+# https://docs.github.com/en/code-security/concepts/secret-security/push-protection
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -12,6 +21,13 @@ repos:
       - id: check-docstring-first
       - id: check-json
       - id: check-toml
+      - id: detect-private-key
+
+  # Secret detection (same approach as usernaut / template-ui)
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.28.0
+    hooks:
+      - id: gitleaks
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.12.2
diff --git a/README.md b/README.md
index b2f77491..63f1877b 100644
--- a/README.md
+++ b/README.md
@@ -149,16 +149,23 @@ See the [examples README](./examples/README.md) for detailed usage instructions.
    uv pip install -e ".[dev]"
    ```
 
-4. **Set up environment variables**
+4. **Install pre-commit** (recommended)
+   ```bash
+   pre-commit install
+   ```
+
+   Or run `make install` (installs deps and hooks). Hooks include `gitleaks` and `detect-private-key` for secret scanning. Also enable [GitHub Secret Scanning](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning) and [Push Protection](https://docs.github.com/en/code-security/concepts/secret-security/push-protection) on the repository for defense in depth.
+
+5. **Set up environment variables**
    ```bash
    cp .env.example .env
    # Edit .env with your configuration
    ```
 
-5. **Run template-mcp-server** following https://github.com/redhat-data-and-ai/template-mcp-server
+6. **Run template-mcp-server** following https://github.com/redhat-data-and-ai/template-mcp-server
 
 
-6. **Run the application**
+7. **Run the application**
    ```bash
    uv run python -m template_agent.src.main
    ```