diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c08c5db
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,20 @@
+---
+name: ci
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  static-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run pre-commit hooks
+        uses: pre-commit/action@v3.0.1
+
+      - name: Check service worker syntax
+        run: node --check makeitwork.cloud/sw.js
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index a0ce71e..0ad5802 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -8,8 +8,15 @@ repos:
       - id: check-json
       - id: check-merge-conflict
       - id: check-yaml
+      - id: detect-private-key
       - id: end-of-file-fixer
       - id: trailing-whitespace
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+        entry: gitleaks dir --redact --verbose .
+        pass_filenames: false
   - repo: https://github.com/rhysd/actionlint
     rev: v1.7.11
     hooks:
diff --git a/AGENTS.md b/AGENTS.md
index 5d1f8d3..73d2f9b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,6 +3,7 @@
 - **Type:** Static Website
 - **Static checks:** `pre-commit run -a`, `node --check makeitwork.cloud/sw.js`
 - **Lint:** `actionlint`, `prettier`
+- **Pull request CI:** Enforces secret scanning and static checks.
 
 # Production Deployment