diff --git a/.github/workflows/utils/.gitleaks.toml b/.gitleaks.toml
similarity index 79%
rename from .github/workflows/utils/.gitleaks.toml
rename to .gitleaks.toml
index 891594dee..47d7efd05 100644
--- a/.github/workflows/utils/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -1,3 +1,5 @@
+# Allowlist for gitleaks and betterleaks. The managed secret-scan workflow runs
+# betterleaks from the repository root, which reads this file.
 title = "Gitleaks config"
 
 [extend]