diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 720cd3f..b0fee0a 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -15,14 +15,29 @@ jobs:
 
       # Installed from the release tarball rather than the marketplace action,
       # which requires a paid licence key for organization-owned repositories.
+      #
+      # Pinned deliberately, for the same reason the retina repos pin ruff: this
+      # is a required check, so resolving `releases/latest` at run time let a new
+      # gitleaks release change what the gate accepts with no commit here and no
+      # way to tell a real new finding from a rules change. Bump VERSION and
+      # SHA256 together; each release ships gitleaks_<VERSION>_checksums.txt.
+      #
+      # The tarball is written to disk and verified before extraction rather than
+      # piped straight into tar, so nothing unverified is ever unpacked. `-f`
+      # makes curl fail on an HTTP error page instead of handing tar an HTML
+      # document, and --retry covers the transient TLS failure seen on ops#2.
       - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
         run: |
           set -euo pipefail
-          TAG="$(curl -sSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r .tag_name)"
-          VERSION="${TAG#v}"
-          echo "installing gitleaks ${TAG}"
-          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/${TAG}/gitleaks_${VERSION}_linux_x64.tar.gz" \
-            | tar -xz gitleaks
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "installing gitleaks ${GITLEAKS_VERSION}"
+          curl -fsSL --retry 3 --retry-delay 5 -o "${TARBALL}" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${TARBALL}"
+          echo "${GITLEAKS_SHA256}  ${TARBALL}" | sha256sum -c -
+          tar -xzf "${TARBALL}" gitleaks
           sudo install -m 755 gitleaks /usr/local/bin/gitleaks
           gitleaks version