diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..adb0e5a
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,14 @@
+# Sulkta gitleaks allowlist for this repo (a fork of txpipe/pallas).
+# These paths hold UPSTREAM Cardano public test fixtures — the mainnet Byron
+# genesis, CBOR/native-script test vectors — whose high-entropy hex strings
+# false-positive as "generic-api-key". They are public on-chain / test data
+# present in every pallas clone. NOT secrets.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Upstream Cardano public test fixtures (not secrets)"
+paths = [
+  '''test_data/''',
+  '''.*\.native$''',
+]