diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8febc8..56506ba 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,10 @@ jobs:
         run: |
           python -m pip install --upgrade pip setuptools wheel
           python -m pip install -e ".[dev]" -c versions.lock
+      - name: Install pre-commit hooks (gitleaks binary)
+        run: |
+          pre-commit install
+          pre-commit install-hooks
       # Separate steps on purpose: a combined step only reports "something
       # failed", and job logs need admin rights to read. One tool per step makes
       # the failure identifiable from the run summary alone.