diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..0c08668
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,18 @@
+# gitleaks config — pallas
+#
+# pallas is the Cardano serialization library. Its repo includes:
+#  - test fixtures in test_data/ and crates/*/test_data/ with vkeys,
+#    keyHashes, vssKeys — all public on-chain identifiers
+#  - mainnet-byron-genesis.json — the Byron genesis block which is
+#    PUBLIC chain data, ships signingKey/vssKey of original Byron
+#    delegates as part of the bootstrap state
+# None of these are secrets in any operational sense.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Cardano test fixtures + Byron genesis (public on-chain data)"
+paths = [
+    '''(.*/)?test_data/.*''',
+]