diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml
index 38d3f7a4..cba2d044 100644
--- a/.github/workflows/secret-scanner-reusable.yml
+++ b/.github/workflows/secret-scanner-reusable.yml
@@ -165,13 +165,21 @@ jobs:
           ref: main
           path: .standards-gitleaks
           sparse-checkout: |
-            .gitleaks.toml
+            config/gitleaks/estate-baseline.toml
           sparse-checkout-cone-mode: false
 
       - name: Stage estate gitleaks baseline
         run: |
           set -euo pipefail
-          cp .standards-gitleaks/.gitleaks.toml .gitleaks-estate.toml
+          # Stage THE estate baseline, not standards' own repo config.
+          # standards/.gitleaks.toml is a CONSUMER of the baseline -- it carries
+          # `[extend] path = "config/gitleaks/estate-baseline.toml"`, and
+          # `[extend] path` resolves against the PROCESS working directory. Copied
+          # into a consumer, that path does not exist and gitleaks dies with
+          #   FTL failed to load extended config ... no such file
+          # scanning nothing and failing the gate. The baseline file's own header
+          # documents this staging as the intended behaviour.
+          cp .standards-gitleaks/config/gitleaks/estate-baseline.toml .gitleaks-estate.toml
           # Delete the tooling checkout BEFORE scanning: otherwise the scan
           # walks standards' own tree and reports ITS files as the caller's.
           # (The Hypatia baseline job above does the same thing for the same