diff --git a/mise.toml b/mise.toml
index 8002af2..33845d5 100644
--- a/mise.toml
+++ b/mise.toml
@@ -4,6 +4,7 @@ pnpm = "11.1.0"
 python = "3.12"
 uv = "latest"
 "npm:node-gyp" = "latest"  # required to build tree-sitter native bindings during `pnpm install`
+"aqua:betterleaks/betterleaks" = "1.2.0"  # secret scanner — used by analyze + pre-release gate
 
 [env]
 # Python venv used to be anchored at packages/eval/.venv while the eval