diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1433348..8c2bf61 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -21,6 +21,16 @@ executors:
 
 # Define the jobs we want to run for this project
 jobs:
+  gitleaks:
+    executor: base
+    steps:
+      - checkout
+      - run:
+          name: Install and run gitleaks (non-blocking)
+          command: |
+            VERSION=8.28.0
+            curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" | tar -xz gitleaks
+            ./gitleaks detect --source . --redact -v --config .gitleaks.toml || echo "gitleaks reported findings (non-blocking during rollout)"
   pre-commit:
     executor: pip-tools-docker
     steps:
@@ -180,6 +190,7 @@ workflows:
     jobs:
       - pre-commit
       - test
+      - gitleaks
   build-test-publish:
     jobs:
       - pre-commit:
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..2d9e54e
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,5 @@
+# Gitleaks config for generative_data_prep. Extends the built-in default ruleset.
+title = "generative_data_prep gitleaks config"
+
+[extend]
+useDefault = true