diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 000000000..e3603fca9
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,7 @@
+# gitleaks finding-specific ignores (exact fingerprints; commit:path:rule:line).
+# These four are confirmed non-credentials: two hex cache-lock test fixtures and
+# two documentation lines matched by the generic-api-key rule.
+498faca9c73bbb3214ca4995dd34c76d699c8544:crates/khive-pack-git/src/cache.rs:generic-api-key:1405
+498faca9c73bbb3214ca4995dd34c76d699c8544:crates/khive-pack-git/src/cache.rs:generic-api-key:1406
+4ce001460f67750796f533b1269c74c90c67eb5c:docs/adr/ADR-101-kg-changeset-model.md:generic-api-key:135
+39fb7052c29916e50f20083f5f6281861bb7ebd9:docs/adr/ADR-101-kg-changeset-model.md:generic-api-key:155