diff --git a/.betterleaks.toml b/.betterleaks.toml
new file mode 100644
index 0000000..cb32a04
--- /dev/null
+++ b/.betterleaks.toml
@@ -0,0 +1,28 @@
+# betterleaks configuration for this repository's own scans.
+#
+# secret-scan.yml auto-discovers this file (config-path defaults to empty),
+# and so do the lefthook betterleaks hooks. It governs THIS repo only —
+# consumers of the reusable workflow bring their own config.
+
+title = "nkg/github-actions"
+
+# Keep the full default ruleset. Without this the file would REPLACE the
+# built-in rules rather than add to them, silently disarming the scan —
+# the same fail-quiet direction the sops-audit allowlist guards against.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = """
+tests/plaintext-scan.test.sh is a corpus of deliberately secret-shaped
+strings: it feeds fixtures to the sops-audit plaintext scanner and asserts
+which ones are caught. Half of them are true-positives by design, so the
+default rules flag them on every full-history scan (generic-password and
+generic-api-key, all low confidence).
+
+Scoped to this one path rather than tests/** — the rest of the tree, test
+files included, stays covered.
+"""
+paths = [
+  '''^tests/plaintext-scan\.test\.sh$''',
+]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 99de1df..8788e16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,20 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
   would let an annotation bind across arbitrary text to an unrelated
   `default:` further down the file.
 
+- Added `.betterleaks.toml` so this repo's own secret scan runs clean.
+  `tests/plaintext-scan.test.sh` is a corpus of deliberately secret-shaped
+  fixtures — half of them true-positives by design, feeding the sops-audit
+  plaintext scanner — so the default rules flagged three of them on every
+  full-history scan. That blocked the `pre-push` betterleaks hook for
+  everyone, from a clean tree, on a branch that had touched nothing related.
+
+  The allowlist is scoped to that single path rather than `tests/**`, and
+  `[extend] useDefault = true` keeps the full 417-rule default set. Both
+  matter: a config file without `extend` *replaces* the built-in rules
+  instead of adding to them, which would disarm the scan while continuing
+  to report success — the same fail-quiet direction the sops-audit
+  allowlist guards against.
+
 ## [3.2.1] - 2026-09-01
 
 ### Fixed