diff --git a/.gitleaksignore b/.gitleaksignore
deleted file mode 100644
index 67185772..00000000
--- a/.gitleaksignore
+++ /dev/null
@@ -1,3 +0,0 @@
-# AWS official example credentials used in tests
-# See: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-access-keys-and-secret-access-keys
-internal/secrets/aws_resolver_httptest_test.go
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 59ddfc5d..078428b3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -61,11 +61,12 @@ repos:
         name: Check for merge conflicts
       - id: detect-private-key
         name: Detect private keys
-        # Audit (PR5): internal/credentials/resolver.go contains zero
-        # private-key-shaped patterns (verified by grep). The exclusion
-        # was a historical artifact; removing it tightens the gate
-        # without breaking any legitimate code.
-        exclude: '(_test\.go|frontend/src/index\.html)$'
+        # No exclusions: no tracked file contains a private-key header, so
+        # the former `_test\.go` and `frontend/src/index.html` exclusions
+        # exempted nothing while letting a key pasted into any Go test
+        # fixture through (#299). A test that genuinely needs a PEM literal
+        # should assemble it at runtime (as scripts/test-git-secrets-allowlist.sh
+        # does) or add a narrow per-file exclude with a written reason.
       - id: check-case-conflict
         name: Check for case conflicts