diff --git a/.github/linters/.gitleaks.toml b/.github/linters/.gitleaks.toml
index bccf2d9..08ac9fb 100644
--- a/.github/linters/.gitleaks.toml
+++ b/.github/linters/.gitleaks.toml
@@ -1,5 +1,8 @@
 title = "gitleaks config"
 
+[extend]
+useDefault = true
+
 [allowlist]
 description = "Allow test fixture data with dummy credentials"
 paths = [
diff --git a/.gitignore b/.gitignore
index 304001d..b38f935 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,7 +39,7 @@ package-lock.json
 # phpunit (if present)
 .phpunit.cache
 .phpunit.result.cache
-phpunit.xml*
+phpunit.xml
 
 # vagrant (if present)
 .vagrant
@@ -57,4 +57,3 @@ Thumbs.db
 .buildpath
 .project
 .settings
-phpunit.xml
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fee70be..ee14748 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## 0.3.2 Under development
 
+- chore: update `.gitleaks.toml` configuration and `scaffold-lock.json` version.
+
 ## 0.3.1 May 06, 2026
 
 - chore: skip `HeredocIndentationFixer` class to preserve heredoc alignment.
diff --git a/scaffold-lock.json b/scaffold-lock.json
index 7bf724e..89f5245 100644
--- a/scaffold-lock.json
+++ b/scaffold-lock.json
@@ -1,7 +1,7 @@
 {
     "providers": {
         "php-forge/baseline": {
-            "version": "0.1.0",
+            "version": "0.1.1",
             "path": "vendor/php-forge/baseline"
         }
     },
@@ -67,7 +67,7 @@
             "mode": "replace"
         },
         ".github/linters/.gitleaks.toml": {
-            "hash": "sha256:c500506cb29afadfd898384f12bcabdf5b494f6f2da982217e0a6e33b10f6ec6",
+            "hash": "sha256:33589aa4b1b2bd29dc30603b2e590d75a83f59da3fcd8e0b7a148c59726efb85",
             "provider": "php-forge/baseline",
             "source": "metadata/.github/linters/.gitleaks.toml",
             "mode": "replace"