diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
new file mode 100644
index 0000000..d325a5c
--- /dev/null
+++ b/.github/workflows/secret-scanner.yml
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MPL-2.0
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). Added because this repository had NO leak scanning at all.
+#
+# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner
+# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+name: "Secret Scanner"
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  secret-scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit