diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e294282..a6dcc08 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,4 +1,6 @@
 # Pre-commit hooks. Install: pip install pre-commit && pre-commit install
+# ggshield (id: ggshield) runs `secret scan pre-commit`. Credentials stay
+# outside this repo (environment or a local ggshield login). Do not commit a key.
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
@@ -6,6 +8,11 @@ repos:
       - id: check-added-large-files
         args: ['--maxkb=1000']
 
+  - repo: https://github.com/GitGuardian/ggshield
+    rev: v1.56.1
+    hooks:
+      - id: ggshield
+
   - repo: local
     hooks:
       - id: ruff