diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed231e77..ee0d3425 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,14 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo fmt --all --check
 
+  detect-secrets:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6.0.2
+      - name: Run detect-secrets
+        run: scripts/ci/detect-secrets.sh
+
   clippy:
     runs-on: ubuntu-latest
     steps:
diff --git a/scripts/ci/detect-secrets.sh b/scripts/ci/detect-secrets.sh
new file mode 100755
index 00000000..118cc602
--- /dev/null
+++ b/scripts/ci/detect-secrets.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly BASELINE="${DETECT_SECRETS_BASELINE:-.secrets.baseline}"
+readonly DETECT_SECRETS_SPEC="${DETECT_SECRETS_SPEC:-git+https://github.com/ibm/detect-secrets.git@076672a9a01abdfc7ecee2e7d14f08cdccb73976}"
+readonly TEMP_ROOT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+readonly VENV="${DETECT_SECRETS_VENV:-${TEMP_ROOT}/detect-secrets-venv}"
+
+if [[ ! -f "${BASELINE}" ]]; then
+    if [[ "${GITHUB_ACTIONS:-false}" == "true" ]]; then
+        echo "::notice::detect-secrets enforcement will start when ${BASELINE} is added"
+    else
+        echo "detect-secrets: ${BASELINE} not found; skipping"
+    fi
+    exit 0
+fi
+
+python3 -m venv "${VENV}"
+PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    "${VENV}/bin/python" -m pip install --quiet "${DETECT_SECRETS_SPEC}"
+
+git ls-files -z | xargs -0 \
+    "${VENV}/bin/detect-secrets-hook" \
+    --baseline "${BASELINE}" \
+    --use-all-plugins \
+    --fail-on-unaudited \
+    --