diff --git a/mise.toml b/mise.toml
index 6851e303..73ef2ed4 100644
--- a/mise.toml
+++ b/mise.toml
@@ -126,11 +126,28 @@ run = [
 ##################
 
 [tasks."security:secrets"]
-description = "Scan all git history for secrets with gitleaks (full-history sweep)"
+description = "Scan the checked-out history for secrets with gitleaks (scheduled sweep + pre-push)"
 # `gitleaks git` (history-aware) replaces the deprecated `gitleaks detect`
-# (removed from --help in v8.19.0). With no --log-opts this scans the full
-# history reachable from the checkout, matching the previous behaviour.
-run = "gitleaks git . --no-banner --redact"
+# (removed from --help in v8.19.0).
+#
+# Scoped to `HEAD` rather than left bare (#721, decision ratified in #723).
+# Bare `gitleaks git .` walks EVERY fetched ref, so a secret in an unmerged,
+# no-PR branch reddens this scan for everyone — it trains reviewers to ignore a
+# red security gate, which is the worst outcome for one.
+#
+# `HEAD` is deliberate, and is NOT interchangeable with `main` here. HEAD is
+# relative: in the scheduled CI run it resolves to `main`, but on pre-push in a
+# feature worktree it also covers the commits being pushed. Pinning this to
+# `main` would skip the developer's own commits — the pre-push hook would stop
+# catching the secret you are about to publish.
+#
+# Do NOT "scope" this with a ref pattern like `--remotes=origin/main`: that
+# matches no ref in a plain worktree, walks 0 commits, and silently turns the
+# scan into a fail-OPEN no-op.
+#
+# Secrets introduced by a PR are independently caught at merge time by the
+# required range-scoped check (`security:secrets:range`, see security-pr.yml).
+run = 'gitleaks git . --no-banner --redact --log-opts="HEAD"'
 
 [tasks."security:secrets:range"]
 description = "gitleaks over a commit range only (per-PR gate). Set GITLEAKS_RANGE, e.g. origin/main..HEAD"