diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
deleted file mode 100644
index 5a4f6fb..0000000
--- a/.github/workflows/gitleaks.yml
+++ /dev/null
@@ -1,83 +0,0 @@
-name: "Gitleaks"
-
-on:
-  push:
-    branches:
-      - main
-    tags-ignore:
-      - '**'
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-    branches:
-      - main
-      - 'release/**'
-
-env:
-  ACTIONS_STEP_DEBUG: '${{ secrets.ACTIONS_STEP_DEBUG }}'
-
-jobs:
-  gitleaks:
-    name: "Gitleaks"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: hmarr/debug-action@v3.0.0
-
-      - name: install
-        shell: bash
-        run: |
-          set -euo pipefail
-          arch="$(uname)_$(uname -m)"
-          platform=$(echo $arch | tr '[:upper:]' '[:lower:]' )
-          echo "PLATFORM=$platform" >> $GITHUB_ENV
-          echo "GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')" >> $GITHUB_ENV
-
-      - name: Cache gitleaks archive
-        id: cache_gitleaks
-        uses: actions/cache@v4
-        with:
-          path: /usr/local/bin/gitleaks
-          key: gitleaks-${{ env.PLATFORM }}-${{ env.GITLEAKS_VERSION }}
-
-      - name: Download and configure gitleaks
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ "${{ steps.cache_gitleaks.outputs.cache-hit }}" != "true" ]]; then
-            DOWNLOAD_URL="https://github.com/gitleaks/gitleaks/releases/download/v${{ env.GITLEAKS_VERSION }}/gitleaks_${{ env.GITLEAKS_VERSION }}_linux_x64.tar.gz"
-            echo "Download Gitleaks ${{ env.GITLEAKS_VERSION }} for ${{ env.PLATFORM }} from ${DOWNLOAD_URL}"
-            curl -fsSL "$DOWNLOAD_URL" | tar xzf - -C /usr/local/bin
-          fi
-          chmod +x /usr/local/bin/gitleaks
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Run gitleaks
-        run: |
-          set -euo pipefail ${ACTIONS_STEP_DEBUG:+-x}
-
-          gitleaks \
-            detect \
-            --source="." \
-            --redact \
-            -v \
-            --exit-code=2 \
-            --report-format=sarif \
-            --report-path=results.sarif \
-            --log-level=debug \
-            --log-opts='${{ github.event.pull_request.base.sha || github.event.before }}..${{ github.event.pull_request.head.sha || github.event.after }}'
-
-      - name: Upload test results
-        if: failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: GitLeaks results
-          path: results.sarif
-          retention-days: 14
diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
new file mode 100644
index 0000000..dbb22ce
--- /dev/null
+++ b/.github/workflows/trufflehog.yml
@@ -0,0 +1,109 @@
+name: "TruffleHog"
+
+# Secret scan of the commits between the base and the head.
+# Unverified results fail the job too: candidates are never sent to their providers.
+# Not a secret? Add `trufflehog:ignore` on its line after the value (not before), or a path regex to .trufflehogignore.
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+    tags-ignore:
+      - '**'
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    branches:
+      - main
+      - 'release/**'
+
+env:
+  ACTIONS_STEP_DEBUG: '${{ secrets.ACTIONS_STEP_DEBUG }}'
+  HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
+  BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+
+jobs:
+  trufflehog:
+    name: "TruffleHog"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: hmarr/debug-action@v3.0.0
+
+      - name: Install
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Authenticated call: unauthenticated api.github.com requests are rate-limited per IP on shared runners
+          TRUFFLEHOG_VERSION="$(curl -fsS -H "Authorization: token ${{ github.token }}" https://api.github.com/repos/trufflesecurity/trufflehog/releases/latest | jq -r .tag_name | sed 's/^v//')"
+          if [[ -z "$TRUFFLEHOG_VERSION" || "$TRUFFLEHOG_VERSION" == "null" ]]; then
+            echo "::error::Failed to resolve trufflehog version (got '${TRUFFLEHOG_VERSION}')"
+            exit 1
+          fi
+          echo "TRUFFLEHOG_VERSION=$TRUFFLEHOG_VERSION" >> "$GITHUB_ENV"
+
+      - name: Cache trufflehog archive
+        id: cache_trufflehog
+        uses: actions/cache@v6
+        with:
+          path: /usr/local/bin/trufflehog
+          key: trufflehog-linux-amd64-${{ env.TRUFFLEHOG_VERSION }}
+
+      - name: Download and configure trufflehog
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ steps.cache_trufflehog.outputs.cache-hit }}" != "true" ]]; then
+            DOWNLOAD_URL="https://github.com/trufflesecurity/trufflehog/releases/download/v${{ env.TRUFFLEHOG_VERSION }}/trufflehog_${{ env.TRUFFLEHOG_VERSION }}_linux_amd64.tar.gz"
+            echo "Download trufflehog ${{ env.TRUFFLEHOG_VERSION }} from ${DOWNLOAD_URL}"
+            curl -fsSL "$DOWNLOAD_URL" | tar xzf - -C /usr/local/bin trufflehog
+          fi
+          chmod +x /usr/local/bin/trufflehog
+
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          token: ${{ github.token }}
+          # 2147483647 is git's "infinite" depth: full history of this ref only, unlike 0 which
+          # also fetches every branch and tag.
+          fetch-depth: 2147483647
+          ref: ${{ env.HEAD_SHA }}
+      - name: Fetch base commit
+        if: env.BASE_SHA != '' && env.BASE_SHA != '0000000000000000000000000000000000000000'
+        run: |
+          set -euo pipefail ${ACTIONS_STEP_DEBUG:+-x}
+
+          # A PR base (base branch tip) is not always an ancestor of the head. Fetch it with full history
+          # so the merge base can be computed; shared history is not re-downloaded.
+          git fetch --no-tags --depth=2147483647 origin "$BASE_SHA"
+
+      - name: Run trufflehog
+        run: |
+          set -uo pipefail ${ACTIONS_STEP_DEBUG:+-x}
+
+          if [[ -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
+            echo "No base commit (new branch): its commits were scanned on the branch they came from."
+            exit 0
+          fi
+          flags=(--no-verification --fail --no-update --json)
+          if [[ -f .trufflehogignore ]]; then
+            flags+=(--exclude-paths=.trufflehogignore)
+          fi
+          # --since-commit must be an ancestor of --branch, otherwise trufflehog scans nothing and
+          # reports success. The merge base always is; the PR base is not once the base branch moves on.
+          trufflehog git file://. \
+            --since-commit="$(git merge-base "$BASE_SHA" "$HEAD_SHA")" \
+            --branch="$HEAD_SHA" \
+            "${flags[@]}" > trufflehog.json
+          rc=$?
+
+          # Print locations only; the JSON holds raw secret values, so it is not uploaded.
+          jq -r '.SourceMetadata.Data.Git as $m
+            | "\(.DetectorName)\t\($m.file):\($m.line)\t\(($m.commit // "")[0:12])"' trufflehog.json
+          exit $rc