diff --git a/.gitattributes b/.gitattributes
index 3919fd6..8770af6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -11,6 +11,8 @@
 /.editorconfig         export-ignore
 /.gitattributes        export-ignore
 /.gitignore            export-ignore
+/.gitguardian.yaml     export-ignore
+/.gitleaks.toml        export-ignore
 /CODE_OF_CONDUCT.md    export-ignore
 /CONTRIBUTING.md       export-ignore
 /SECURITY.md           export-ignore
diff --git a/.gitguardian.yaml b/.gitguardian.yaml
new file mode 100644
index 0000000..6472213
--- /dev/null
+++ b/.gitguardian.yaml
@@ -0,0 +1,13 @@
+# Secret-scan policy. Written by agent-kit's secret_scan.py; extend it by hand, narrowly.
+#
+# ggshield reads this file (pre-commit, CI, local scans). The GitGuardian GitHub App, which posts
+# the "GitGuardian Security Checks" run on pull requests, does not: its exclusions live in the
+# GitGuardian dashboard (Settings -> Secrets detection -> Exclusion rules).
+#
+# Only named fixture and example-env paths are ignored. Never src/, never a real .env, never a
+# detector. secret_scan.py still searches these paths for live-format keys. If a finding is real,
+# rotate it first and then remove it; never add it here.
+version: 2
+secret:
+  ignored_paths:
+    - "tests/fixtures/**/*"
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..a92232f
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,12 @@
+# gitleaks policy. Written by agent-kit's secret_scan.py; extend it by hand, narrowly.
+# Only named fixture and example-env paths are allowlisted; secret_scan.py still
+# searches them for live-format keys. A realistic fake elsewhere carries an inline
+# `gitleaks:allow` comment instead.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Named fixture and example-env paths (agent-kit secret_scan.py)"
+paths = [
+  '''^tests/fixtures/(?:.*/)?[^/]*$''',
+]