diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index e64cd68..1279028 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -1,9 +1,8 @@
 ###############################################################################
-# Secret scan — public Gitleaks action
+# Secret scan
 #
-# https://github.com/gitleaks/gitleaks-action
-# Org repos need a free GITLEAKS_LICENSE (gitleaks.io) as an Actions secret.
-# Comments and SARIF upload are off so a finding is not published on a public PR.
+# Calls the public org scanner on main. Allow-list updates there apply on the
+# next run, with no pin bump in this repo. gitleaks git scans the full history.
 ###############################################################################
 
 name: Secret scan
@@ -23,21 +22,6 @@ permissions:
 jobs:
   gitleaks:
     name: Secret Scan (Gitleaks)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        # actions/checkout v4.3.1
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Run Gitleaks
-        # gitleaks/gitleaks-action v3.0.0
-        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
-          GITLEAKS_ENABLE_COMMENTS: "false"
-          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
+    permissions:
+      contents: read
+    uses: m0-platform/secret-scan/.github/workflows/secret-scan.yml@main