diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index d59fd10..d723ecf 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,6 +9,13 @@ on:
       php-extensions:
         type: string
         default: 'mbstring, xml, ctype, iconv, intl'
+    secrets:
+      GITGUARDIAN_API_KEY:
+        description: >-
+          GitGuardian API key. Optional: without it the scan step is skipped with a warning rather
+          than failing, so adding this job cannot turn every caller red before the key exists.
+          A caller must pass `secrets: inherit` (or the key by name) for it to arrive at all.
+        required: false
 
 jobs:
   composer-audit:
@@ -61,3 +68,39 @@ jobs:
           scan-args: |-
             --recursive
             ./
+
+  secret-scan:
+    name: ggshield secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # ggshield scans the range a pull request adds, so it needs the history to diff against.
+          fetch-depth: 0
+
+      # The key is optional, and the job says so rather than failing closed on configuration.
+      # Failing closed is right for a FINDING -- a leaked credential must stop the build -- and
+      # wrong for a missing setting, which would paint every caller red for a reason none of them
+      # introduced. Same shape as simtabi/repo-templates' Refresh Bot credentials gate.
+      - name: Is the scanner configured?
+        id: creds
+        env:
+          HAS_KEY: ${{ secrets.GITGUARDIAN_API_KEY != '' }}
+        run: |
+          if [ "${HAS_KEY}" = true ]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning title=ggshield not configured::No GITGUARDIAN_API_KEY reached this workflow, so no secret scan ran. Add it as an org secret and have the caller pass secrets: inherit."
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: ggshield secret scan
+        if: steps.creds.outputs.ready == 'true'
+        uses: GitGuardian/ggshield-action@5cc1ed2be3e8bf625d354c7170731880670f74de # v1.56.1
+        env:
+          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
+          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
+          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}