diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml
new file mode 100644
index 00000000..cd8bb584
--- /dev/null
+++ b/.github/workflows/secrets-scan.yml
@@ -0,0 +1,40 @@
+name: Secret Scanning (gitleaks)
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_SARIF_OUTPUT: gitleaks.sarif
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install gitleaks
+        run: bash ci/setup-tools.sh --install-tool gitleaks
+
+      - name: Install and run gitleaks
+        run: >
+          gitleaks dir .
+          --config ci/suppress_gitleaks.toml
+          --redact
+          --report-format sarif
+          --report-path "$GITLEAKS_SARIF_OUTPUT"
+
+      - name: Upload SARIF to code scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 #v2.25.6
+        with:
+          sarif_file: ${{ env.GITLEAKS_SARIF_OUTPUT }}
+          category: gitleaks
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000..3fd08481
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,24 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v6.0.0
+  hooks:
+    - id: trailing-whitespace
+    - id: end-of-file-fixer
+      exclude: .bumpversion.cfg
+    - id: check-merge-conflict
+      exclude: LICENSE
+    - id: check-added-large-files
+    - id: check-yaml
+    - id: check-json
+    - id: pretty-format-json
+      args: ["--autofix"]
+      exclude: slack.json
+    - id: check-xml
+    - id: detect-private-key
+    - id: check-case-conflict
+    - id: mixed-line-ending
+
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.30.0
+  hooks:
+    - id: gitleaks
diff --git a/Dockerfile b/Dockerfile
index 3dd0d1f8..da46be23 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Step 1: Build the Angular app
-FROM node:22-alpine AS build
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS build
 WORKDIR /app
 
 # Install dependencies with cache mount for npm cache
@@ -28,7 +28,7 @@ RUN --mount=type=cache,target=/app/.angular/cache \
     npm run build -- --configuration ${BUILD_CONFIGURATION}
 
 # Step 2: Use Nginx to serve the Angular app
-FROM nginx:alpine-slim
+FROM nginx:alpine-slim@sha256:45b82ed5f285b90d63df07ba70430fdd8f25624b416617d9e6dc93412b2006dc
 RUN apk upgrade --no-cache \
     && apk add --no-cache gettext-envsubst
 ENV PLATFORM_BACKEND_SERVER=platform-backend-service:8080 \
@@ -50,4 +50,4 @@ RUN chown -R nginx:nginx /usr/share/nginx/html /etc/nginx/conf.d /var/cache/ngin
 
 USER nginx
 EXPOSE 80
-CMD ["/docker-entrypoint.sh"]
\ No newline at end of file
+CMD ["/docker-entrypoint.sh"]
diff --git a/ci/setup-tools.sh b/ci/setup-tools.sh
index c24ca8de..510453ee 100644
--- a/ci/setup-tools.sh
+++ b/ci/setup-tools.sh
@@ -30,6 +30,10 @@ SEMGREP_RULES_DIR="semgrep-rules"
 HADOLINT_VERSION="${HADOLINT_VERSION:-v2.14.0}"
 HADOLINT_SHA256="${HADOLINT_SHA256:-6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47}"
 
+# renovate: datasource=github-release-attachments depName=gitleaks/gitleaks
+GITLEAKS_VERSION="${GITLEAKS_VERSION:-v8.30.1}"
+GITLEAKS_SHA256="${GITLEAKS_SHA256:-551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb}"
+
 # renovate: datasource=npm depName=@cyclonedx/cyclonedx-npm
 CYCLONEDX_NPM_VERSION="${CYCLONEDX_NPM_VERSION:-6.0.0}"
 
@@ -128,6 +132,19 @@ if should_install "hadolint"; then
   echo "Hadolint installed OK"
 fi
 
+# --- Gitleaks -----------------------------------------------------------
+if should_install "gitleaks"; then
+  echo "[setup-tools] Installing Gitleaks ${GITLEAKS_VERSION}"
+  GITLEAKS_TARBALL="gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz"
+  download_and_verify \
+    "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/${GITLEAKS_TARBALL}" \
+    "${TMP_DIR}/${GITLEAKS_TARBALL}" \
+    "${GITLEAKS_SHA256}"
+  sudo tar -xzf "${TMP_DIR}/${GITLEAKS_TARBALL}" -C /usr/local/bin gitleaks
+  gitleaks version
+  echo "Gitleaks installed OK"
+fi
+
 # --- SBOM generation ----------------------------------------------------
 case "$SBOM_ECOSYSTEM" in
   maven)
diff --git a/ci/suppress_gitleaks.toml b/ci/suppress_gitleaks.toml
new file mode 100644
index 00000000..939307ae
--- /dev/null
+++ b/ci/suppress_gitleaks.toml
@@ -0,0 +1,6 @@
+# No allowlist needed currently.
+# Add an [allowlist] section here if false positives need excluding later:
+# [allowlist]
+# paths = [
+#   '''test/fixtures/.*''',
+# ]