diff --git a/.github/workflows/required-gitleaks.yml b/.github/workflows/required-gitleaks.yml
new file mode 100644
index 0000000..16f0fc8
--- /dev/null
+++ b/.github/workflows/required-gitleaks.yml
@@ -0,0 +1,15 @@
+# Keep the shared ref pinned to a reviewed full commit SHA.
+name: Required secret scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    uses: QuantStrategyLab/.github/.github/workflows/gitleaks.yml@0da4da68433b803cda17d3f84e29875a94a32273
diff --git a/.github/workflows/weekly-gitleaks.yml b/.github/workflows/weekly-gitleaks.yml
new file mode 100644
index 0000000..5eb2bfa
--- /dev/null
+++ b/.github/workflows/weekly-gitleaks.yml
@@ -0,0 +1,17 @@
+# Keep the shared ref pinned to a reviewed full commit SHA.
+name: Weekly all-branch secret scan
+
+on:
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    uses: QuantStrategyLab/.github/.github/workflows/gitleaks.yml@0da4da68433b803cda17d3f84e29875a94a32273
+    with:
+      full-history: true